US5581616A - Method and apparatus for digital signature authentication - Google Patents

Method and apparatus for digital signature authentication Download PDF

Info

Publication number
US5581616A
US5581616A US08/484,264 US48426495A US5581616A US 5581616 A US5581616 A US 5581616A US 48426495 A US48426495 A US 48426495A US 5581616 A US5581616 A US 5581616A
Authority
US
United States
Prior art keywords
key
sub
message
receiver
mod
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Lifetime
Application number
US08/484,264
Inventor
Richard E. Crandall
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Next Software Inc
Original Assignee
Next Software Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from US07/761,276 external-priority patent/US5159632A/en
Application filed by Next Software Inc filed Critical Next Software Inc
Priority to US08/484,264 priority Critical patent/US5581616A/en
Assigned to NEXT COMPUTER, INC. reassignment NEXT COMPUTER, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: CRANDALL, RICHARD E.
Assigned to NEXT SOFTWARE, INC. reassignment NEXT SOFTWARE, INC. CHANGE OF NAME (SEE DOCUMENT FOR DETAILS). Assignors: NEXT COMPUTER, INC.
Priority to US08/758,688 priority patent/US5805703A/en
Publication of US5581616A publication Critical patent/US5581616A/en
Application granted granted Critical
Priority to US08/896,993 priority patent/US6307935B1/en
Priority to US09/149,876 priority patent/US6049610A/en
Priority to US09/544,530 priority patent/US6285760B1/en
Priority to US09/946,967 priority patent/US6751318B2/en
Priority to US10/857,250 priority patent/US7603560B2/en
Anticipated expiration legal-status Critical
Expired - Lifetime legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H04L9/3066Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F7/00Methods or arrangements for processing data by operating upon the order or content of the data handled
    • G06F7/60Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
    • G06F7/72Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
    • G06F7/724Finite field arithmetic
    • G06F7/725Finite field arithmetic over elliptic curves
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F7/00Methods or arrangements for processing data by operating upon the order or content of the data handled
    • G06F7/60Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers
    • G06F7/72Methods or arrangements for performing computations using a digital non-denominational number representation, i.e. number representation without radix; Computing devices using combinations of denominational and non-denominational quantity representations, e.g. using difunction pulse trains, STEELE computers, phase computers using residue arithmetic
    • G06F7/727Modulo N arithmetic, with N being either (2**n)-1,2**n or (2**n)+1, e.g. mod 3, mod 4 or mod 5

Definitions

  • This invention relates to the field of cryptographic systems.
  • a cryptographic system is a system for sending a message from a sender to a receiver over a medium so that the message is "secure", that is, so that only the intended receiver can recover the message.
  • a cryptographic system converts a message, referred to as "plaintext" into an encrypted format, known as "ciphertext.”
  • the encryption is accomplished by manipulating or transforming the message using a "cipher key” or keys.
  • the receiver "decrypts" the message, that is, converts it from ciphertext to plaintext, by reversing the manipulation or transformation process using the cipher key or keys. So long as only the sender and receiver have knowledge of the cipher key, such an encrypted transmission is secure.
  • a "classical” cryptosystem is a cryptosystem in which the enciphering information can be used to determine the deciphering information.
  • a classical cryptosystem requires that the enciphering key be kept secret and provided to users of the system over secure channels. Secure channels, such as secret couriers, secure telephone transmission lines, or the like, are often impractical and expensive.
  • a system that eliminates the difficulties of exchanging a secure enciphering key is known as "public key encryption.”
  • a public key cryptosystem has the property that someone who knows only how to encipher a message cannot use the enciphering key to find the deciphering key without a prohibitively lengthy computation.
  • An enciphering function is chosen so that once an enciphering key is known, the enciphering function is relatively easy to compute. However, the inverse of the encrypting transformation function is difficult, or computationally infeasible, to compute. Such a function is referred to as a "one way function" or as a "trap door function.”
  • certain information relating to the keys is public. This information can be, and often is, published or transmitted in a non-secure manner. Also, certain information relating to the keys is private. This information may be distributed over a secure channel to protect its privacy, (or may be created by a local user to ensure privacy).
  • FIG. 1 A block diagram of a typical public key cryptographic system is illustrated in FIG. 1.
  • a sender represented by the blocks within dashed line 100 sends a plaintext message Ptxt to a receiver, represented by the blocks within dashed line 115.
  • the plaintext message is encrypted into a ciphertext message C, transmitted over some transmission medium and decoded by the receiver 115 to recreate the plaintext message Ptxt.
  • the sender 100 includes a cryptographic device 101, a secure key generator 102 and a key source 103.
  • the key source 103 is connected to the secure key generator 102 through line 104.
  • the secure key generator 102 is coupled to the cryptographic device 101 through line 105.
  • the cryptographic device provides a ciphertext output C on line 106.
  • the secure key generator 102 provides a key output on line 107. This output is provided, along with the ciphertext message 106, to transmitter receiver 109.
  • the transmitter receiver 109 may be, for example, a computer transmitting device such as a modem or it may be a device for transmitting radio frequency transmission signals.
  • the transmitter receiver 109 outputs the secure key and the ciphertext message on an insecure channel 110 to the receiver's transmitter receiver 111.
  • the receiver 115 also includes a cryptographic device 116, a secure key generator 117 and a key source 118.
  • the key source 118 is coupled to the secure key generator 117 on line 119.
  • the secure key generator 117 is coupled to the cryptographic device 116 on line 120.
  • the cryptographic device 116 is coupled to the transmitter receiver 111 through line 121.
  • the secure key generator 117 is coupled to the transmitter receiver 111 on lines 122 and 123.
  • the sender 100 has a plaintext message Ptxt to send to the receiver 115.
  • Both the sender 100 and the receiver 115 have cryptographic devices 101 and 116, respectively, that use the same encryption scheme.
  • cryptographic devices 101 and 116 There are a number of suitable cryptosystems that can be implemented in the cryptographic devices. For example, they may implement the Data Encryption Standard (DES) or some other suitable encryption scheme.
  • DES Data Encryption Standard
  • Sender and receiver also have secure key generators 102 and 117, respectively.
  • These secure key generators implement any one of several well known public key exchange schemes. These schemes, which will be described in detail below, include the Diffie-Hellman scheme, the RSA scheme, the Massey-Omura scheme, and the ElGamal scheme.
  • the sender 100 uses key source 103, which may be a random number generator, to generate a private key.
  • the private key is provided to the secure key generator 102 and is used to generate an encryption key e K .
  • the encryption key e K is transmitted on lines 105 to the cryptographic device and is used to encrypt the plaintext message Ptxt to generate a ciphertext message C provided on line 106 to the transmitter receiver 109.
  • the secure key generator 102 also transmits the information used to convert to the secure key from key source 103 to the encryption key e K . This information can be transmitted over an insecure channel, because it is impractical to recreate the encryption key from this information without knowing the private key.
  • the receiver 115 uses key source 118 to generate a private and secure key 119.
  • This private key 119 is used in the secure key generator 117 along with the key generating information provided by the sender 100 to generate a deciphering key D K .
  • This deciphering key D K is provided on line 120 to the cryptographic device 116 where it is used to decrypt the ciphertext message and reproduce the original plaintext message.
  • a directory of public keys is published or otherwise made available to the public.
  • a given public key is dependent on its associated private key, known only to a user.
  • a sender has a public key, referred to as "ourPub”.
  • a receiver has a public key, referred to here as “theirPub”.
  • the sender also has a private key, referred to here as "myPri”.
  • the receiver has a private key, referred to here as "theirPri”.
  • Public keys are easily created using exponentiation and modulo arithmetic. As noted previously, public keys are easily obtainable by the public. They are published and distributed. They may also be transmitted over non-secure channels. Even though the public keys are known, it is very difficult to calculate the private keys by the inverse function because of the difficulty in solving the discrete log problem.
  • FIG. 2 illustrates a flow chart that is an example of a key exchange using a Diffie-Hellman type system.
  • a prime number p is chosen. This prime number p is public.
  • a primitive root g is chosen. This number g is also publicly known.
  • an enciphering key e K is generated, the receiver's public key (theirPub) is raised to the power of the sender's private key (myPri). That is:
  • Equation 3 can be given by:
  • This value is the enciphering key e K that is used to encipher the plaintext message and create a ciphertext message.
  • the particular method for enciphering or encrypting the message may be any one of several well known methods. Whichever encrypting message is used, the cipher key is the value calculated in Equation 4. The ciphertext message is then sent to the receiver at step 204.
  • the receiver generates a deciphering key D K by raising the public key of the sender (myPri) to the private key of the receiver (theirPri) as follows:
  • a one-time pad is a key used in enciphering and deciphering a message.
  • step 205 can be performed prior to or contemporaneously with any of steps 201-204.
  • ⁇ (n) (p-1)(q-1).
  • ⁇ (n) is the number of integers between 1 and n that have no common factor with n).
  • a random number E is then chosen between 1 and ⁇ (n)-1 and which has no common factors with ⁇ (n).
  • the Massey-Omura cryptosystem is described in U.S. Pat. No. 4,567,600.
  • a finite field F q is selected.
  • the field F q is fixed and is a publicly known field.
  • the Massey-Omura cryptosystem requires that three messages be sent to achieve a secure transmission.
  • Sender A sends message P to receiver B.
  • Sender A calculates random number e A and receiver B calculates random number e B .
  • the sender first sends the receiver the element P e A .
  • the receiver is unable to recover P since the receiver does not know e A . Instead, the receiver raises the element to his own private key e B and sends a second message P e A e B back to the sender.
  • the sender then removes the effect of e A by raising the element to the D A-th power and returns P eB to the receiver B.
  • the receiver B can read this message by raising the element to the D B-th power.
  • the integer a is the private deciphering key.
  • the public enciphering key is the element g a F q .
  • To send a message represented by P to a user A an integer K is randomly chosen.
  • a pair of elements of F q namely (g K , pg aK ) are sent to A.
  • the plaintext message Ptxt is encrypted with the key g aK .
  • the value g K is a "clue" to the receiver for determining the plaintext message Ptxt.
  • this clue can only be used by someone who knows the secure deciphering key "a”.
  • the receiver A who knows "a", recovers the message P from this pair by raising the first element gK ath and dividing the result into
  • An elliptic curve cryptosystem is based on points on an elliptic curve E defined over a finite field F.
  • Elliptic curve cryptosystems rely for security on the difficulty in solving the discrete logarithm problem.
  • An advantage of an elliptic curve cryptosystem is there is more flexibility in choosing an elliptic curve than in choosing a finite field. Nevertheless, elliptic curve cryptosystems have not been widely used in computer-based public key exchange systems due to their computational intensiveness. Computer-based elliptic curve cryptosystems are slow compared to other computer public key exchange systems.
  • Elliptic curve cryptosystems are described in "A Course in Number Theory and Cryptography" (Koblitz, 1987, Springer-Verlag, New York).
  • f A is used to send a message to user A
  • f B is the enciphering transformation used to send a message to user B.
  • User A provides a "signature" P that may include some specific information, such as the time the message was sent or an identification number.
  • User A transmits the signature as f B f A -1 (P).
  • a point R is calculated using P, the digested version of the ciphertext message and P, and myPub. If R and Q do not compare exactly, the signature is not valid (not genuine).
  • the security of this scheme relies on the computational infeasability of breaking the elliptic logarithm operation or the hash function M.
  • a disadvantage of this scheme is that it is computationally intensive, making it complex and slow in operation.
  • the present invention improves speed and reduces complexity in a digital signature scheme that uses elliptic algebra.
  • the signature scheme generates two points that are compared. If the points do not match, the signature is not authentic.
  • the present invention reduces computations by comparing only the x coordinates of the two generated points.
  • the invention provides a scheme for deducing the possible values of the x-coordinate of a sum of two points using only the x coordinates of the original two points in question.
  • the present invention provides a scheme that limits the possible solutions that satisfy the equation to two (the authentic signature and one other). Because of the large number of possible inauthentic solutions, the chance of a false authentic signature is statistically insignificant.
  • FIG. 1 is a block diagram of a prior art public key exchange system.
  • FIG. 2 is a flow diagram of a prior art public key exchange transaction.
  • FIG. 3 is a flow diagram illustrating the key exchange of the present invention.
  • FIG. 4 is a block diagram of a computer system on which the present invention may be implemented.
  • FIG. 5 is a diagram illustrating the shift and add operations for performing mod p arithmetic using Mersenne primes.
  • FIG. 6 is a diagram illustrating the operations for performing mod p arithmetic using Fermat numbers.
  • FIG. 7 is a diagram illustrating the operations for performing mod p arithmetic using fast class numbers.
  • FIG. 8 is a block diagram of the present invention.
  • FIG. 9 is a flow diagram illustrating the operation of one embodiment of the present invention.
  • FIG. 10 is a flow diagram illustrating the generation of a digital signature using the present invention.
  • FIG. 11 is a flow diagram illustrating the authentication of a digital signature in the present invention.
  • FIG. 12 illustrates a block diagram for implementing the digital signature scheme of the present invention.
  • a disadvantage of prior art computer-implemented elliptic curve encryption schemes is they are unsatisfactorily slow compared to other prior art computer-implemented encryption schemes.
  • the modulo arithmetic and elliptical algebra operations required in a prior art elliptic curve cryptosystem require that divisions be performed. Divisions increase computer CPU (central processing unit) computational overhead. CPU's can perform addition and multiplication operations more quickly, and in fewer processing steps, than division operations. Therefore, prior art elliptic curve cryptosystems have not been previously practical or desirable as compared to other prior art cryptosystems, such as Diffie-Hellman and RSA schemes.
  • the present invention provides methods and apparatus for implementing an elliptic curve cryptosystem for public key exchange that does not require explicit division operations.
  • the advantages of the preferred embodiment of the present invention are achieved by implementing fast classes of numbers, inversionless parameterization, and FFT multiply mod operations.
  • the elliptic curve used with the present invention is comprised of points (x,y) ⁇ F.sbsb.p k XF.sbsb.p k satisfying:
  • the present invention uses an operation referred to as "elliptic multiplication” and represented by the symbol "°".
  • the operation of elliptic multiplication can be described as follows:
  • Equation 7 An initial point (X 1 , Y 1 ) on the curve of Equation 7 is defined.
  • expression n°(X 1 , Y 1 ) denotes the point (X n , Y n ) obtained via the following relations, known as adding and doubling rules.
  • Both sender and recipient use the same set of such parameters. Both sender and recipient generate a mutual one-time pad, as a particular x-coordinate on the elliptic curve.
  • the terms “our” and “our end” refer to the sender.
  • the terms “their” and “their end” refer to the receiver. This convention is used because the key exchange of the present invention may be accomplished between one or more senders and one or more receivers. Thus, “our” and “our end” and “their” and “their end” refers to one or more senders and receivers, respectively.
  • the public key exchange of the elliptic curve cryptosystem of the present invention is illustrated in the flow diagram of FIG. 3.
  • a one-time pad is computed at their end: theirPad ⁇ F.sbsb.p k
  • step 305 can be executed prior to or contemporaneously with any of steps 301-304).
  • the sender encrypts plaintext message Ptxt using ourPad, and transmits ciphertext message C to the receiver.
  • the receiver decrypts ciphertext message C to recover plaintext message Ptxt, using theirPad.
  • Elliptic curve cryptosystems make use of modulo arithmetic to determine certain parameters, such as public keys, one time pads, etc.
  • modulo arithmetic serves the dual purpose of limiting the number of bits in the results of equations to some fixed number, and providing security.
  • the discrete log problem is asymmetrical in part because of the use of modulo arithmetic.
  • a disadvantage of modulo arithmetic is the need to perform division operations.
  • the solution to a modulo operation is the remainder when a number is divided by a fixed number. For example, 12 mod 5 is equal to 2. (5 divides into 12 twice with a remainder of 2, the remainder 2 is the solution). Therefore, modulo arithmetic requires division operations.
  • Special fast classes of numbers are used in the present invention to optimize the modulo arithmetic required in the enciphering and deciphering process by eliminating the need for division operations.
  • the class of numbers used in the present invention is generally described by the form 2 q -C where C is an odd number and is relatively small, (e.g. no longer than the length of a computer word.
  • the equation 2 q -C does not result in a prime number for all values of q. and C
  • q is equal to 4
  • C is equal to 1
  • 2 q -C is equal to 15, not a prime.
  • the equation 2 q -C generates the prime numbers 3, 7, and 31.
  • the present invention implements elliptic curves over a finite field F.sbsb.p k where p is 2 q -C is an element of a fast class of numbers.
  • fast class numbers allow the (mod p) operations to be accomplished using only shifts and adds.
  • slow requires that time consuming division operations be executed to perform (mod p) arithmetic.
  • the following examples illustrate the advantage of fast class number (mod p) arithmetic.
  • n mod 127 can be calculated by division as follows: ##STR1##
  • the remainder 112 is the solution to n mod 127.
  • the (mod p) arithmetic can be accomplished by using the binary form of n, namely 11101101111010111100011100110101.
  • the shifts and adds are accomplished by first latching the q least significant bits (LSB's) 501 of n, namely 0110101.
  • the q LSB's 502 of the remaining digits, namely 0001110, are then added to q digits 501, resulting in sum 503 (1000011).
  • the next q LSB's 504 of n, (0101111) are added to sum 503, generating sum 505, (1110010).
  • Bits 506 of n (1101111) are added to sum 505, to result in sum 507, (11100001).
  • the solution 112 to n mod 127 is determined using only shifts and adds when an elliptic curve over a field of Mersenne primes is used.
  • the use of Mersenne primes in conjunction with elliptic curve cryptosystems eliminates explicit divisions.
  • the (mod p) arithmetic can be accomplished by using the binary form of n, namely 11101101111010111100011100110101.
  • the shifts and adds are accomplished by first latching the q (8) least significant bits (LSB's) 601 (00110101).
  • the next q LSB's 602 of the remaining digits, namely 11000111, are to be subtracted from q digits 601.
  • the 1's complement of bits 602 is generated and a 1 is added to the MSB side to indicate a negative number, resulting in bits 602' (100111000). This negative number 602' is added to bits 601 to generate result 603 (101101101).
  • Sum 607 has more than q bits so the q LSB's are latched as bits 608 (01101010).
  • the next q bits (in this case, only two bits, 11) are added to bits 608, generating sum 610 (01101101).
  • the (mod p) arithmetic can be accomplished by using the binary form of n, namely 1010101101.
  • the shifts and adds are accomplished by first latching the q (4) least significant bits (LSB's) 701 of n, namely 1101.
  • the remaining bits 702 (101010) are multiplied by C (3) to generate product 703 (1111110).
  • Product 703 is added to bits 701 to generate sum 704 (10001011).
  • the q least significant bits 705 (1011) of sum 704 are latched.
  • the remaining bits 706 (1000) are multiplied by C to generate product 707 (11000).
  • Product 707 is added to bits 705 to generate sum 708 (100011).
  • the q least significant bits 709 (0011) of sum 708 are latched.
  • the remaining bits 710 (10) are multiplied by C to generate product 711 (110).
  • Product 711 is added to bits 709 to generate sum 712 (1001).
  • the fast class arithmetic provides the solution using only shifts, adds, and multiplies.
  • the binary extended-GCD procedure can be performed without explicit division via the operation [a/b] 2 , defined as the greatest power of 2 not exceeding a/b:
  • the present invention may be implemented on any conventional or general purpose computer system.
  • An example of one embodiment of a computer system for implementing this invention is illustrated in FIG. 4.
  • a keyboard 410 and mouse 411 are coupled to a bi-directional system bus 419.
  • the keyboard and mouse are for introducing user input to the computer system and communicating that user input to CPU 413.
  • the computer system of FIG. 4 also includes a video memory 414, main memory 415 and mass storage 412, all coupled to bi-directional system bus 419 along with keyboard 410, mouse 411 and CPU 413.
  • the mass storage 412 may include both fixed and removable media, such as magnetic, optical or magnetic optical storage systems or any other available mass storage technology.
  • the mass storage may be shared on a network, or it may be dedicated mass storage.
  • Bus 419 may contain, for example, 32 address lines for addressing video memory 414 or main memory 415.
  • the system bus 419 also includes, for example, a 32-bit data bus for transferring data between and among the components, such as CPU 413, main memory 415, video memory 414 and mass storage 412.
  • multiplex data/address lines may be used instead of separate data and address lines.
  • the CPU 413 is a 32-bit microprocessor manufactured by Motorola, such as the 68030 or 68040. However, any other suitable microprocessor or microcomputer may be utilized.
  • the Motorola microprocessor and its instruction set, bus structure and control lines are described in MC68030 User's Manual, and MC68040 User's Manual, published by Motorola Inc. of Phoenix, Ariz.
  • Main memory 415 is comprised of dynamic random access memory (DRAM) and in the preferred embodiment of this invention, comprises 8 megabytes of memory. More or less memory may be used without departing from the scope of this invention.
  • Video memory 414 is a dual-ported video random access memory, and this invention consists, for example, of 256 kbytes of memory. However, more or less video memory may be provided as well.
  • Video multiplexer and shifter 416 is coupled to video amplifier 417.
  • the video amplifier 417 is used to drive the cathode ray tube (CRT) raster monitor 418.
  • Video multiplexing shifter circuitry 416 and video amplifier 417 are well known in the art and may be implemented by any suitable means. This circuitry converts pixel data stored in video memory 414 to a raster signal suitable for use by monitor 418.
  • Monitor 418 is a type of monitor suitable for displaying graphic images, and in the preferred embodiment of this invention, has a resolution of approximately 1020 ⁇ 832. Other resolution monitors may be utilized in this invention.
  • the computer system described above is for purposes of example only.
  • the present invention may be implemented in any type of computer system or programming or processing environment.
  • FIG. 8 is a block diagram of the present invention.
  • a sender represented by the components within dashed line 801, encrypts a plaintext message Ptxt to a ciphertext message C.
  • This message C is sent to a receiver, represented by the components within dashed line 802.
  • the receiver 802 decrypts the ciphertext message C to recover the plaintext message Ptxt.
  • the sender 801 comprises an encryption/decryption means 803, an elliptic multiplier 805, and a private key source 807.
  • the encryption/decryption means 803 is coupled to the elliptic multiplier 805 through line 809.
  • the elliptic multiplier 805 is coupled to the private key source 807 through line 811.
  • the encryption/decryption means 804 of receiver 802 is coupled to elliptic multiplier 806 through line 810.
  • the elliptic multiplier 806 is coupled to the private key source 808 through line 812.
  • the private key source 807 of the sender 801 contains the secure private password of the sender, "ourPri".
  • Private key source 807 may be a storage register in a computer system, a password supplied by the sender to the cryptosystem when a message is sent, or even a coded, physical key that is read by the cryptosystem of FIG. 8 when a message is sent or received.
  • the private key source 808 of receiver 802 contains the secure private password of the receiver, namely, "theirPri".
  • a separate source 813 stores publicly known information, such as the public keys "ourPub” and “theirPub” of sender 801 and receiver 802, the initial point (x 1 , y 1 ), the field F.sbsb.p k , and curve parameter "a".
  • This source of information may be a published directory, an on-line source for use by computer systems, or it may transmitted between sender and receiver over a non-secure transmission medium.
  • the public source 813 is shown symbolically connected to sender 801 through line 815 and to receiver 802 through line 814.
  • the sender and receiver generate a common one time pad for use as an enciphering and deciphering key in a secure transmission.
  • the private key of the sender, ourPri is provided to the elliptic multiplier 805, along with the sender's public key, theirPub.
  • the elliptic multiplier 805 computes an enciphering key e K from (ourPri)°(theirPub) (mod p).
  • the enciphering key is provided to the encryption/decryption means 803, along with the plaintext message Ptxt.
  • the enciphering key is used with an encrypting scheme, such as the DES scheme or the elliptic curve scheme of the present invention, to generate a ciphertext message C.
  • the ciphertext message is transmitted to the receiver 802 over a nonsecure channel 816.
  • the receiver 802 generates a deciphering key D K using the receiver's private key, theirPri. TheirPri is provided from the private key source 808 to the elliptic multiplier 804, along with sender's public key, ourPub, (from the public source 813). Deciphering key D K is generated from (theirPri)°(ourPub) (mod p). The deciphering key D K is equal to the enciphering key e K due to the abelian nature of the elliptic multiplication function. Therefore, the receiver 802 reverses the encryption scheme, using the deciphering key D K , to recover the plaintext message Ptxt from the ciphertext message C.
  • the encryption/decryption means and elliptic multiplier of the sender 801 and receiver 802 can be implemented as program steps to be executed on a microprocessor.
  • both sender and recipient generate a mutual one-time pad, as a particular x-coordinate on the elliptic curve.
  • n denotes the coordinate (X n+m /Z n+m ).
  • x X/Z
  • x-coordinate of the multiple n(x, y) as X n /Z n is calculated using a "binary ladder" method in accordance with the adding-doubling rules, which involve multiply mod operations:
  • a public key exchange using the method of the present invention can proceed as follows.
  • the prime is a Mersenne prime.
  • any of the fast class numbers described herein may be substituted.
  • the use of FFT multiply techniques results in the ability to perform multiply-mod in a time roughly proportional to q log q, rather than q 2 .
  • Elliptic curve algebra can be sped up intrinsically with FFT techniques. Let X denote generally the Fourier transform of the digits of X, this transform being the same one used in FFT multiplication. Then we can compute coordinates from equations 21-24. To compute X i+j for example, we can use five appropriate transforms, (X i , X j , Z i , Z j , and Z i-j ) (some of which can have been stored previously) to create the transform:
  • FIG. 9 A flow diagram illustrating the operation of the present invention when using fast class numbers, inversionless parameterization and FFT multiply operations is illustrated in FIG. 9.
  • the term q is the bit depth of the encryption scheme. The greater the number of bits, the greater the security. For large values of q, FFT multiply operations are used to calculate p.
  • the term p is made publicly available.
  • the element k for the field F.sbsb.p k is chosen and made public.
  • an initial point (X 1 /Z) on the elliptic curve is selected. By selecting the initial point to be inversionless, costly divides are avoided.
  • the initial point is made public.
  • the curve parameter a is chosen at step 904 and made public.
  • the receiver's public key theirPub (XZ -1 )(mod p), is generated at step 906.
  • a one time pad for the sender, ourPad, is generated at step 907.
  • X/Z (ourPri)°(theirPub/1).
  • ourPad XZ -1 (mod p).
  • a one time pad for the receiver, theirPad, is generated.
  • X/Z (theirPri)°(ourPub/1).
  • theirPad XZ -1 (mod p).
  • the calculation of ourPad and theirPad utilizes FFT multiplies to eliminate the need to calculate the inversion Z -1 .
  • the sender converts a plaintext message Ptxt to a ciphertext message C using ourPad.
  • the ciphertext message C is transmitted to the receiver.
  • the receiver recovers the plaintext message Ptxt by deciphering the ciphertext message C using theirPad.
  • the inequality avoids the trivial reduction of the discrete logarithm evaluation to the equivalent evaluation over a corresponding finite field. Failures of the inequality are extremely rare, in fact no non-trivial instances are known at this time for q>89.
  • the present invention provides a number of advantages over prior art schemes, particularly factoring schemes such as the RSA scheme.
  • the present invention can provide the same security with fewer bits, increasing speed of operation. Alternatively, for the same number of bits, the system of the present invention provides greater security.
  • Another advantage of the present cryptosystem over prior art cryptosystems is the distribution of private keys.
  • prior art schemes such as RSA
  • large prime numbers must be generated to create private keys.
  • the present invention does not require that the private key be a prime number. Therefore, users can generate their own private keys, so long as a public key is generated and published using correct and publicly available parameters p, F.sbsb.p k , (X 1 /Z) and "a".
  • a user cannot generate its own private key in the RSA system.
  • the present invention provides an improved method for creating and authenticating a digital signature that uses the elliptic algebra described above and a hashing or digesting function.
  • the sender has prepared an encrypted message "ciphertext". This message may be encrypted as described above or may be encrypted using any other encryption scheme.
  • the sender then creates a digital signature to append to the message as a way of "signing" the message.
  • the signature scheme of the preferred embodiment is described below, followed by the method of reducing computations.
  • ciphertext is the encrypted message to be sent.
  • a message digesting function M such as MD2 or MD5 is used as part of the creation of the digital signature.
  • MD2 message digesting function
  • MD5 message digesting function
  • the present invention may be implemented using other digesting functions or by using any suitable hashing function.
  • the receiver attempts to authenticate the signature by generating a pair of points to match the digital signature pair, using the ciphertext message and the public key of the purported sender.
  • the receiver verifies the signature using the following steps:
  • the signature is invalid if these elliptic points Q and R do not compare exactly. In other words, if the signature is authentic, the following must hold:
  • a point on a curve is calculated via two different equations using the transmitted pair (u, P). It can be seen that by calculating Q from the transmitted point u, and by calculating R from transmitted point P, the ciphertext message, and the public key of the purported sender, the digital signature is assumed authenticated when Q and R match.
  • the recipient's final step in the digital signature scheme of the present invention involves the addition of two points; namely P and M(ciphertext, P)°ourPub to yield R and comparing that sum to a point Q.
  • P and M(ciphertext, P)°ourPub to yield R and comparing that sum to a point Q.
  • the scheme of the present invention provides a method of deducing the possible values of the x-coordinate of a sum of two points, using only the respective x-coordinates of the original two points in question. Using this method one may rapidly perform a necessity check on whether the points Q and the sum of P+M(ciphertext, P)°ourPub have identical x-coordinates.
  • One solution corresponds to an authentic signature.
  • P 1 represents the calculated point P that is sent as part of the signature by the sender.
  • P 2 represents the expression M(ciphertext, P)°ourPub.
  • Q of course represents u°(X 1 /1).
  • P 1 +P 2 represents R and is compared to Q.
  • FIG. 10 is a flow diagram illustrating the generation of a digital signature using the present invention.
  • the sender chooses a random integer m.
  • This random integer can be generated using a suitable random number generator for use with a microprocessor.
  • hashing functions other than digesting functions MD2 and MD5 can be used.
  • other relationships can be used to calculate u. It is recommended that if other relationships are used, that m, P, ourPri and the ciphertext message be used.
  • the calculated pair (u, P) is sent as a digital signature.
  • FIG. 11 is a flow diagram illustrating the authentication of a digital signature in the present invention.
  • the recipient of the message recieves the digital signature (u, P) and the ciphertext message.
  • the point Q is generated using the point u.
  • Other relationships may be used depending on what relationships were used to calculate u, P by the sender.
  • a point P 2 is generated using ourPub and the ciphertext message.
  • the relationship M(ciphertext, P)°ourPub is used to generate P 2 .
  • Other relationships may be used depending on what relationships were used to calculate u, P by the sender.
  • the x values of P 1 and P 2 are used to determine values b and c and ultimately, e and f. This leads to to possible x values for the sum of P 1 and P 2 .
  • FIG. 12 illustrates a block diagram for implementing the digital signature scheme of the present invention. Where elements of FIG. 12 are in common with elements of FIG. 8, the same element numbers are used.
  • the signature scheme is shown in use with an encryption scheme that uses elliptic multiplication, but this is by way of example only.
  • the present invention can be used with any type of encryptions scheme.
  • a sender represented by the components within dashed line 1201, encrypts a plaintext message Ptxt to a ciphertext message C and generates a signature (u, P).
  • This message C and signature (u, P) is sent to a receiver, represented by the components within dashed line 1202.
  • the receiver 1202 decrypts the ciphertext message C to recover the plaintext message, and authenticates the signature (u, P).
  • the sender 1201 comprises an encryption/decryption means 1203, an elliptic multiplier 805, a random number generator 1205, a hasher 1207, and a private key source 807.
  • the encryption/decryption means 1203 is coupled to the elliptic multiplier 805 through line 809.
  • the elliptic multiplier 805 is coupled to the private key source 807 through line 811.
  • the random number generator 1205 provides random number rn on line 1209 to elliptic multiplier 805 and to hasher 1207.
  • Elliptic multiplier 805 provides point u to the nonsecure channel 816 via line 1211.
  • the encrypted ciphertext C is provided to hasher 1207 via line 1213.
  • Hasher 1207 provides point P to nonsecure channel 816 via line 1215.
  • the encryption/decryption means 1204 of receiver 1202 is coupled to elliptic multiplier 806 through line 810.
  • the elliptic multiplier 806 is coupled to the private key source 808 through line 812.
  • the point u is provided to the elliptic multiplier 806 from the nonsecure channel 816 via line 1212.
  • Elliptic multiplier 806 generates point Q and provides it to comparator 1208 via line 1216.
  • Hasher 1206 recieves the ciphertext message C and point P from nonsecure channel 816 via line 1210, and ourPub from source 813 via line 1218.
  • Hasher 1206 outputs point R to comparator 1208 via line 1214.
  • the private key source 807 of the sender 801 contains the secure private password of the sender, "ourPri".
  • Private key source 807 may be a storage register in a computer system, a password supplied by the sender to the cryptosystem when a message is sent, or even a coded, physical key that is read by the cryptosystem of FIG. 12 when a message is sent or received.
  • the private key source 808 of receiver 802 contains the secure private password of the receiver, namely, "theirPri”.
  • a separate source 813 stores publicly known information, such as the public keys "ourPub”and “theirPub” of sender 1201 and receiver 1202, the initial point (x 1 , y 1 ), the field F.sbsb.p k , and curve parameter "a".
  • This source of information may be a published directory, an on-line source for use by computer systems, or it may transmitted between sender and receiver over a non-secure transmission medium.
  • the public source 813 is shown symbolically connected to sender 1201 through line 815 and to receiver 1202 and hasher 1206 through lines 814 and 1218 respectively.
  • the sender and receiver generate a common one time pad for use as an enciphering and deciphering key in a secure transmission, as described above.
  • the enciphering key is provided to the encryption/decryption means 1203, along with the plaintext message.
  • the enciphering key is used with an encrypting scheme, such as the DES scheme or the elliptic curve scheme of the present invention, to generate a ciphertext message C.
  • the random number generator 1205 generates random number m and provides it to elliptic multiplier 805.
  • Elliptic multiplier 805 generates point u and provides it to the receiver via nonsecure channel 816.
  • the ciphertext message C is provided to the hasher 1207, along with the random number m and ourPri.
  • Hasher 1207 generates point P and provides it to nonsecure channel 816.
  • the ciphertext message, along with signature (u, P), is transmitted to the receiver 1202 over a nonsecure channel 816.
  • the receiver 1202 generates a deciphering key D K using the receiver's private key, theirPri. TheirPri is provided from the private key source 808 to the elliptic multiplier 806, along with sender's public key, ourPub, (from the public source 813). Deciphering key D K is generated from (theirPri)°(ourPub) (mod p). The deciphering key D K is equal to the enciphering key e K due to the abelian nature of the elliptic multiplication function. Therefore, the receiver 1202 reverses the encryption scheme, using the deciphering key D K , to recover the plaintext message from the ciphertext message C.
  • the elliptic multiplier 806 of the receiver 1202 receives point u from the nonsecure channel 816.
  • the elliptic multiplier 806 generates point Q and provides it to comparator 1208.
  • Comparator 1208 compares points Q and R and if they match, the signature is assumed to be valid. In the present invention, the comparison of points Q and R is accomplished using the optimized scheme using x values described above.
  • the encryption/decryption means and elliptic multiplier of the sender 1201 and receiver 1202 can be implemented as program steps to be executed on a microprocessor.
  • the encryption/decryption schemes of the present invention can be implemented in the programming language C.
  • the following are examples of programmatic interfaces (.h files) and test programs (.c files) suitable for implementing the encryption/decryption of the present invention. ##SPC1##

Abstract

The present invention improves speed and reduces complexity in a digital signature scheme that uses elliptic algebra. The signature scheme generates two points that are compared. If the points do not match, the signature is not authentic. The present invention reduces computations by comparing only the x coordinates of the two generated points. The invention provides a scheme for deducing the possible values of the x-coordinate of a sum of two points using only the x coordinates of the original two points in question. The present invention provides a scheme that limits the possible solutions that satisfy the equation to two (the authentic signature and one other). Because of the large number of possible inauthentic solutions, the chance of a false authentic signature is statistically insignificant.

Description

This is a continuation in part of U.S. patent application Ser. No. 08/167,408 filed Dec. 14, 1993 (now issued as U.S. Pat. No. 5,463,690) which is a continuation of U.S. patent application Ser. No. 07/955,479 filed Oct. 2, 1992 (now issued as U.S. Pat. No. 5,271,061) which is a continuation of U.S. application Ser. No. 07/761,276 filed Sep. 17, 1991 (now issued as U.S. Pat. No. 5,159,632).
BACKGROUND OF THE PRESENT INVENTION
1. Field of the Invention
This invention relates to the field of cryptographic systems.
2. Background Art
A cryptographic system is a system for sending a message from a sender to a receiver over a medium so that the message is "secure", that is, so that only the intended receiver can recover the message. A cryptographic system converts a message, referred to as "plaintext" into an encrypted format, known as "ciphertext." The encryption is accomplished by manipulating or transforming the message using a "cipher key" or keys. The receiver "decrypts" the message, that is, converts it from ciphertext to plaintext, by reversing the manipulation or transformation process using the cipher key or keys. So long as only the sender and receiver have knowledge of the cipher key, such an encrypted transmission is secure.
A "classical" cryptosystem is a cryptosystem in which the enciphering information can be used to determine the deciphering information. To provide security, a classical cryptosystem requires that the enciphering key be kept secret and provided to users of the system over secure channels. Secure channels, such as secret couriers, secure telephone transmission lines, or the like, are often impractical and expensive.
A system that eliminates the difficulties of exchanging a secure enciphering key is known as "public key encryption." By definition, a public key cryptosystem has the property that someone who knows only how to encipher a message cannot use the enciphering key to find the deciphering key without a prohibitively lengthy computation. An enciphering function is chosen so that once an enciphering key is known, the enciphering function is relatively easy to compute. However, the inverse of the encrypting transformation function is difficult, or computationally infeasible, to compute. Such a function is referred to as a "one way function" or as a "trap door function." In a public key cryptosystem, certain information relating to the keys is public. This information can be, and often is, published or transmitted in a non-secure manner. Also, certain information relating to the keys is private. This information may be distributed over a secure channel to protect its privacy, (or may be created by a local user to ensure privacy).
A block diagram of a typical public key cryptographic system is illustrated in FIG. 1. A sender represented by the blocks within dashed line 100 sends a plaintext message Ptxt to a receiver, represented by the blocks within dashed line 115. The plaintext message is encrypted into a ciphertext message C, transmitted over some transmission medium and decoded by the receiver 115 to recreate the plaintext message Ptxt.
The sender 100 includes a cryptographic device 101, a secure key generator 102 and a key source 103. The key source 103 is connected to the secure key generator 102 through line 104. The secure key generator 102 is coupled to the cryptographic device 101 through line 105. The cryptographic device provides a ciphertext output C on line 106. The secure key generator 102 provides a key output on line 107. This output is provided, along with the ciphertext message 106, to transmitter receiver 109. The transmitter receiver 109 may be, for example, a computer transmitting device such as a modem or it may be a device for transmitting radio frequency transmission signals. The transmitter receiver 109 outputs the secure key and the ciphertext message on an insecure channel 110 to the receiver's transmitter receiver 111.
The receiver 115 also includes a cryptographic device 116, a secure key generator 117 and a key source 118. The key source 118 is coupled to the secure key generator 117 on line 119. The secure key generator 117 is coupled to the cryptographic device 116 on line 120. The cryptographic device 116 is coupled to the transmitter receiver 111 through line 121. The secure key generator 117 is coupled to the transmitter receiver 111 on lines 122 and 123.
In operation, the sender 100 has a plaintext message Ptxt to send to the receiver 115. Both the sender 100 and the receiver 115 have cryptographic devices 101 and 116, respectively, that use the same encryption scheme. There are a number of suitable cryptosystems that can be implemented in the cryptographic devices. For example, they may implement the Data Encryption Standard (DES) or some other suitable encryption scheme.
Sender and receiver also have secure key generators 102 and 117, respectively. These secure key generators implement any one of several well known public key exchange schemes. These schemes, which will be described in detail below, include the Diffie-Hellman scheme, the RSA scheme, the Massey-Omura scheme, and the ElGamal scheme.
The sender 100 uses key source 103, which may be a random number generator, to generate a private key. The private key is provided to the secure key generator 102 and is used to generate an encryption key eK. The encryption key eK is transmitted on lines 105 to the cryptographic device and is used to encrypt the plaintext message Ptxt to generate a ciphertext message C provided on line 106 to the transmitter receiver 109. The secure key generator 102 also transmits the information used to convert to the secure key from key source 103 to the encryption key eK. This information can be transmitted over an insecure channel, because it is impractical to recreate the encryption key from this information without knowing the private key.
The receiver 115 uses key source 118 to generate a private and secure key 119. This private key 119 is used in the secure key generator 117 along with the key generating information provided by the sender 100 to generate a deciphering key DK. This deciphering key DK is provided on line 120 to the cryptographic device 116 where it is used to decrypt the ciphertext message and reproduce the original plaintext message.
The Diffie-Hellman Scheme
A scheme for public key exchange is presented in Diffie and Hellman, "New Directions in Cryptography," IEEE Trans. Inform. Theory, vol. IT-22, pp. 644-654, November 1976 (The "DH" scheme). The DH scheme describes a public key system based on the discrete exponential and logarithmic functions. If "q" is a prime number and "a" is a primitive element, then X and Y are in a 1:1 correspondence for 1≦X, Y≦(q-1) where Y=aX mod q, and X=loga Y over the finite field. The first discrete exponential function is easily evaluated for a given a and X, and is used to compute the public key Y. The security of the Diffie-Hellman system relies on the fact that no general, fast algorithms are known for solving the discrete logarithm function X=loga Y given X and Y.
In a Diffie-Hellman system, a directory of public keys is published or otherwise made available to the public. A given public key is dependent on its associated private key, known only to a user. However, it is not feasible to determine the private key from the public key. For example, a sender has a public key, referred to as "ourPub". A receiver has a public key, referred to here as "theirPub". The sender also has a private key, referred to here as "myPri". Similarly, the receiver has a private key, referred to here as "theirPri".
There are a number of elements that are publicly known in a public key system. In the case of the Diffie-Hellman system, these elements include a prime number p and a primitive element g. p and g are both publicly known. Public keys are then generated by raising g to the private key power (mod p). For example, a sender's public key myPub is generated by the following equation:
myPub=g.sup.myPri (mod p)                                  Equation (1)
Similarly, the receiver's public key is generated by the equation:
theirPub=g.sup.theirPri (mod p)                            Equation (2)
Public keys are easily created using exponentiation and modulo arithmetic. As noted previously, public keys are easily obtainable by the public. They are published and distributed. They may also be transmitted over non-secure channels. Even though the public keys are known, it is very difficult to calculate the private keys by the inverse function because of the difficulty in solving the discrete log problem.
FIG. 2 illustrates a flow chart that is an example of a key exchange using a Diffie-Hellman type system. At step 201, a prime number p is chosen. This prime number p is public. Next, at step 202, a primitive root g is chosen. This number g is also publicly known. At step 203 an enciphering key eK is generated, the receiver's public key (theirPub) is raised to the power of the sender's private key (myPri). That is:
(theirPub).sup.myPri (mod p)                               Equation (3)
We have already defined theirPub equal to gtheirPri (mod p). Therefore Equation 3 can be given by:
(g.sup.theirPri).sup.myPri (mod p)                         Equation (4)
This value is the enciphering key eK that is used to encipher the plaintext message and create a ciphertext message. The particular method for enciphering or encrypting the message may be any one of several well known methods. Whichever encrypting message is used, the cipher key is the value calculated in Equation 4. The ciphertext message is then sent to the receiver at step 204.
At step 205, the receiver generates a deciphering key DK by raising the public key of the sender (myPri) to the private key of the receiver (theirPri) as follows:
D.sub.K =(myPub).sup.theirPri (mod p)                      Equation (5)
From Equation 1, myPub is equal to gmyPri (mod p). Therefore:
D.sub.K =(g.sup.myPri).sup.theirPri (mod p)                Equation (6)
Since (gA)B is equal to (gB)A, the encipher key eK and the deciphering key DK are the same key. These keys are referred to as a "one-time pad." A one-time pad is a key used in enciphering and deciphering a message.
The receiver simply executes the inverse of the transformation algorithm or encryption scheme using the deciphering key to recover the plaintext message at step 206. Because both the sender and receiver must use their private keys for generating the enciphering key, no other users are able to read or decipher the ciphertext message. Note that step 205 can be performed prior to or contemporaneously with any of steps 201-204.
RSA
Another public key cryptosystem is proposed in Rivest, Shamir and Adelman, "On Digital Signatures and Public Key Cryptosystems," Commun. Ass. Comput. Mach., vol. 21, pp. 120-126, February 1978 (The "RSA" scheme). The RSA scheme is based on the fact that it is easy to generate two very large prime numbers and multiply them together, but it is much more difficult to factor the result, that is, to determine the very large prime numbers from their product. The product can therefore be made public as part of the enciphering key without compromising the prime numbers that effectively constitute the deciphering key.
In the RSA scheme a key generation algorithm is used to select two large prime numbers p and q and multiply them to obtain n=pq. The numbers p and q can be hundreds of decimal digits in length. Then Euler's function is computed as φ(n)=(p-1)(q-1). (φ(n) is the number of integers between 1 and n that have no common factor with n). φ(n) has the property that for any integer a between 0 and n-1 and any integer k, akφ(n)+1 =a (mod n).
A random number E is then chosen between 1 and φ(n)-1 and which has no common factors with φ(n). The random number E is the enciphering key and is public. This then allows D=E-1 mod φ(n) to be calculated easily using an extended version of Euclid's algorithm for computing the greatest common divisor of two numbers. D is the deciphering key and is kept secret.
The information (E, n) is made public as the enciphering key and is used to transform unenciphered, plaintext messages into ciphertext messages as follows: a message is first represented as a sequence of integers each between 0 and n-1. Let P denote such an integer. Then the corresponding ciphertext integer is given by the relation C=PE mod n. The information (D, n) is used as the deciphering key to recover the plaintext from the ciphertext via P=CD mod n. These are inverse transformations because CD =PED =Pkφ(n)+1 =P.
MASSEY-OMURA
The Massey-Omura cryptosystem is described in U.S. Pat. No. 4,567,600. In the Massey cryptosystem, a finite field Fq is selected. The field Fq is fixed and is a publicly known field. A sender and a receiver each select a random integer e between 0 and q-1 so that the greatest common denominator G. C. D. (e, q-1)=1. The user then computes its inverse D=e-1 mod q-1 using the euclidian algorithm. Therefore, De=1 mod q-1.
The Massey-Omura cryptosystem requires that three messages be sent to achieve a secure transmission. Sender A sends message P to receiver B. Sender A calculates random number eA and receiver B calculates random number eB. The sender first sends the receiver the element Pe A. The receiver is unable to recover P since the receiver does not know eA. Instead, the receiver raises the element to his own private key eB and sends a second message Pe A e B back to the sender. The sender then removes the effect of eA by raising the element to the DA-th power and returns PeB to the receiver B. The receiver B can read this message by raising the element to the DB-th power.
ELGAMAL CRYPTOSYSTEM
The ElGamal public key cryptosystem utilizes a publicly known finite field Fq and an element g of F*q. Each user randomly chooses an integer a=to aA in the range 0>a>q-1. The integer a is the private deciphering key. The public enciphering key is the element ga Fq. To send a message represented by P to a user A, an integer K is randomly chosen. A pair of elements of Fq, namely (gK, pgaK) are sent to A. The plaintext message Ptxt is encrypted with the key gaK. The value gK is a "clue" to the receiver for determining the plaintext message Ptxt. However, this clue can only be used by someone who knows the secure deciphering key "a". The receiver A, who knows "a", recovers the message P from this pair by raising the first element gKath and dividing the result into the second element.
ELLIPTIC CURVES
Another form of public key cryptosystem is referred to as an "elliptic curve" cryptosystem. An elliptic curve cryptosystem is based on points on an elliptic curve E defined over a finite field F. Elliptic curve cryptosystems rely for security on the difficulty in solving the discrete logarithm problem. An advantage of an elliptic curve cryptosystem is there is more flexibility in choosing an elliptic curve than in choosing a finite field. Nevertheless, elliptic curve cryptosystems have not been widely used in computer-based public key exchange systems due to their computational intensiveness. Computer-based elliptic curve cryptosystems are slow compared to other computer public key exchange systems. Elliptic curve cryptosystems are described in "A Course in Number Theory and Cryptography" (Koblitz, 1987, Springer-Verlag, New York).
AUTHENTICATION
In addition to protecting the contents of a transmitted message, it is also desired to provide a way to determine the "authenticity" of the message. That is, is the message actually from the purported sender. A scheme for accomplishing this is to append a so-called "digital signature" to the message. One such scheme is described in Koblitz, supra. The enciphering transformation fA is used to send a message to user A and fB is the enciphering transformation used to send a message to user B. User A provides a "signature" P that may include some specific information, such as the time the message was sent or an identification number. User A transmits the signature as fB fA -1 (P). When user B deciphers the message using fB -1, the entire message is decoded into plaintext except the signature portion, which remains fA -1 (P). User B then applies user A's public key fA to obtain P. Since P could only have been encrypted by user A (because only user A knows fA -1) user B can assume that the message was sent by user A.
Another scheme of digital signature authentication is a generalization of the ElGamal discrete logarithm scheme, using elliptic algebra. Assume a public key ourPub generated with a function of a private key ourPri. The signature is generated by first choosing a random integer m of approximately q bits. Next a point P=m°(X1 /1) is computed. A message digest function M is used to compute an integer u that is a function of m, ourPri, and the digested version of the ciphertext message and the computed point P. The computed pair (u, P) is transmitted as the signature.
At the receiving end, the u value of the signature is used to compute the point Q=u°(X1 /1). A point R is calculated using P, the digested version of the ciphertext message and P, and myPub. If R and Q do not compare exactly, the signature is not valid (not genuine). The security of this scheme relies on the computational infeasability of breaking the elliptic logarithm operation or the hash function M. A disadvantage of this scheme is that it is computationally intensive, making it complex and slow in operation.
SUMMARY OF THE INVENTION
The present invention improves speed and reduces complexity in a digital signature scheme that uses elliptic algebra. The signature scheme generates two points that are compared. If the points do not match, the signature is not authentic. The present invention reduces computations by comparing only the x coordinates of the two generated points. The invention provides a scheme for deducing the possible values of the x-coordinate of a sum of two points using only the x coordinates of the original two points in question. The present invention provides a scheme that limits the possible solutions that satisfy the equation to two (the authentic signature and one other). Because of the large number of possible inauthentic solutions, the chance of a false authentic signature is statistically insignificant.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 is a block diagram of a prior art public key exchange system.
FIG. 2 is a flow diagram of a prior art public key exchange transaction.
FIG. 3 is a flow diagram illustrating the key exchange of the present invention.
FIG. 4 is a block diagram of a computer system on which the present invention may be implemented.
FIG. 5 is a diagram illustrating the shift and add operations for performing mod p arithmetic using Mersenne primes.
FIG. 6 is a diagram illustrating the operations for performing mod p arithmetic using Fermat numbers.
FIG. 7 is a diagram illustrating the operations for performing mod p arithmetic using fast class numbers.
FIG. 8 is a block diagram of the present invention.
FIG. 9 is a flow diagram illustrating the operation of one embodiment of the present invention.
FIG. 10 is a flow diagram illustrating the generation of a digital signature using the present invention.
FIG. 11 is a flow diagram illustrating the authentication of a digital signature in the present invention.
FIG. 12 illustrates a block diagram for implementing the digital signature scheme of the present invention.
DETAILED DESCRIPTION OF THE INVENTION
An elliptic curve encryption scheme is described. In the following description, numerous specific details, such as number of bits, execution time, etc., are set forth in detail to provide a more thorough description of the present invention. It will be apparent, however, to one skilled in the art, that the present invention may be practiced without these specific details. In other instances, well known features have not been described in detail so as not to obscure the present invention.
A disadvantage of prior art computer-implemented elliptic curve encryption schemes is they are unsatisfactorily slow compared to other prior art computer-implemented encryption schemes. The modulo arithmetic and elliptical algebra operations required in a prior art elliptic curve cryptosystem require that divisions be performed. Divisions increase computer CPU (central processing unit) computational overhead. CPU's can perform addition and multiplication operations more quickly, and in fewer processing steps, than division operations. Therefore, prior art elliptic curve cryptosystems have not been previously practical or desirable as compared to other prior art cryptosystems, such as Diffie-Hellman and RSA schemes.
The present invention provides methods and apparatus for implementing an elliptic curve cryptosystem for public key exchange that does not require explicit division operations. The advantages of the preferred embodiment of the present invention are achieved by implementing fast classes of numbers, inversionless parameterization, and FFT multiply mod operations.
Elliptic Curve Algebra
The elliptic curve used with the present invention is comprised of points (x,y) εF.sbsb.pk XF.sbsb.pk satisfying:
b y.sup.2 =x.sup.3 +a x.sup.2 +x                           Equation (7)
together with a "point at infinity" a.
Sender ("our") and recipient ("their") private keys are assumed to be integers, denoted:
ourPri, theirPri ε Z Next, parameters are established for both sender and recipient. The parameters are: (mod p)
q, so that p=2q -C is a fast class number (q is the "bit-depth"). The value q is a publicly known value.
k, so that F.sbsb.pk will be the field, and where k is publicly known.
(x1, y1) ε F.sbsb.pk, the initial x-coordinate, which is publicly known.
a ε F.sbsb.pk, the curve-defining parameter (b is not needed). The value a is also publicly known.
The present invention uses an operation referred to as "elliptic multiplication" and represented by the symbol "°". The operation of elliptic multiplication can be described as follows:
An initial point (X1, Y1) on the curve of Equation 7 is defined. For the set of integers n, expression n°(X1, Y1) denotes the point (Xn, Yn) obtained via the following relations, known as adding and doubling rules.
X.sub.n+1 =((Y.sub.n -Y.sub.1)/(X.sub.n -X.sub.1)).sup.2 -X.sub.1 -X.sub.nEquation (8)
Y.sub.n+1 =-Y.sub.1 +((Y.sub.n -Y.sub.1)/(X.sub.n -X.sub.1))(X.sub.1. -X.sub.n+1)                                               Equation (9)
When (X1, Y1)=(Xn, Yn), the doubling relations to be used are:
X.sub.n+1 =((3X.sub.1.sup.2 +a)/2Y.sub.1).sup.2 -2X.sub.1 ;Equation (10)
Y.sub.n+1 =-Y.sub.1 +((3X.sub.1.sup.2 +a)/2Y.sub.1)(X.sub.1 -X.sub.n+1)Equation (11)
Because arithmetic is performed over the field F.sbsb.pk, all operations are to be performed (mod p). In particular, the division operation in equations 8 to 11 involve inversions (mod p).
Elliptic Curve Public Key Exchange
It is necessary that both sender and recipient use the same set of such parameters. Both sender and recipient generate a mutual one-time pad, as a particular x-coordinate on the elliptic curve.
In the following description, the terms "our" and "our end" refer to the sender. The terms "their" and "their end" refer to the receiver. This convention is used because the key exchange of the present invention may be accomplished between one or more senders and one or more receivers. Thus, "our" and "our end" and "their" and "their end" refers to one or more senders and receivers, respectively. The public key exchange of the elliptic curve cryptosystem of the present invention is illustrated in the flow diagram of FIG. 3.
Step 301
At our end, a public key is computed: ourPub ε F.sbsb.pk
ourPub=(ourPri)°(x.sub.1, y.sub.1)                  Equation (12)
Step 302
At their end, a public key is computed: theirPub ε F.sbsb.pk
theirPub=(theirPri)°(x.sub.1, y.sub.1)              Equation (13)
Step 303
The two public keys ourPub and theirPub are published, and therefore known to all users.
Step 304
A one-time pad is computed at our end: ourPad ε F.sbsb.pk
ourPad=(ourPri)°(theirPub)=(ourPri)°(theirPri)°(x.sub.1, y.sub.1)                                                Equation (14)
Step 305
A one-time pad is computed at their end: theirPad ε F.sbsb.pk
theirPad=(theirPri)°(ourPub)=(theirPri)°(ourPri)°(x.sub.1, y.sub.1)                                              Equation (15)
The elements (theirPri)°(ourPri)°(x1, y1) being part of a finite field, form an abelian group. Therefore, the order of operation of equations 14 and 15 can be changed without affecting the result of the equations. Therefore:
ourPad=(ourPri)°(theirPri)°(x.sub.1, y.sub.1)=(theirPri)°(ourPri)°(x.sub.1, y.sub.1)=theirPadEquation (16)
Since both the sender and receiver use the same one time pad, the message encrypted by the sender can be decrypted by the recipient, using the one time pad. (Note that step 305 can be executed prior to or contemporaneously with any of steps 301-304).
At step 306, the sender encrypts plaintext message Ptxt using ourPad, and transmits ciphertext message C to the receiver. At step 307, the receiver decrypts ciphertext message C to recover plaintext message Ptxt, using theirPad.
Fast Class Numbers
Elliptic curve cryptosystems make use of modulo arithmetic to determine certain parameters, such as public keys, one time pads, etc. The use of modulo arithmetic serves the dual purpose of limiting the number of bits in the results of equations to some fixed number, and providing security. The discrete log problem is asymmetrical in part because of the use of modulo arithmetic. A disadvantage of modulo arithmetic is the need to perform division operations. The solution to a modulo operation is the remainder when a number is divided by a fixed number. For example, 12 mod 5 is equal to 2. (5 divides into 12 twice with a remainder of 2, the remainder 2 is the solution). Therefore, modulo arithmetic requires division operations.
Special fast classes of numbers are used in the present invention to optimize the modulo arithmetic required in the enciphering and deciphering process by eliminating the need for division operations. The class of numbers used in the present invention is generally described by the form 2q -C where C is an odd number and is relatively small, (e.g. no longer than the length of a computer word.
When a number is of this form, modulo arithmetic can be accomplished using shifts and adds only, eliminating the need for divisions. One subset of this fast class is known as "Mersenne" primes, and are of the form 2q -1. Another class that can be used with the present invention are known as "Fermat" numbers of the form 2q +1, where q is equal to 2m. Fermat numbers may be prime or not prime in the present invention.
The present invention utilizes elliptic curve algebra over a finite field F.sbsb.pk where p=2q -C and p is a fast class number. Note that the equation 2q -C does not result in a prime number for all values of q. and C For example, when q is equal to 4, and C is equal to 1, 2q -C is equal to 15, not a prime. However, when q has a value of 2, 3, or 5, and C=1 the equation 2q -C generates the prime numbers 3, 7, and 31.
The present invention implements elliptic curves over a finite field F.sbsb.pk where p is 2q -C is an element of a fast class of numbers. When practiced on a computer using binary representations of data, the use of fast class numbers allows the (mod p) operations to be accomplished using only shifts and adds. By contrast, the use of "slow" numbers requires that time consuming division operations be executed to perform (mod p) arithmetic. The following examples illustrate the advantage of fast class number (mod p) arithmetic.
EXAMPLE 1
base 10 (mod p) division
Consider the 32 bit digital number n, where n=111010111100011100110101 (In base 10 this number is 3,991,652,149).
Now consider n (mod p) where p is equal to 127. The expression n mod 127 can be calculated by division as follows: ##STR1##
The remainder 112 is the solution to n mod 127.
EXAMPLE 2
Mersenne Prime (mod p) Arithmetic
In the present invention, when p is a Mersenne prime where p=2q -1, the (mod p) arithmetic can be accomplished using only shifts and adds, with no division required. Consider again n (mod p) where n is 3,991,652,149 and p is 127. When p is 127, q is equal to 7, from p=2q -1; 127=27 -1=128-1=127.
The (mod p) arithmetic can be accomplished by using the binary form of n, namely 11101101111010111100011100110101. Referring to FIG. 5, the shifts and adds are accomplished by first latching the q least significant bits (LSB's) 501 of n, namely 0110101. The q LSB's 502 of the remaining digits, namely 0001110, are then added to q digits 501, resulting in sum 503 (1000011). The next q LSB's 504 of n, (0101111), are added to sum 503, generating sum 505, (1110010). Bits 506 of n (1101111) are added to sum 505, to result in sum 507, (11100001).
The remaining bits 508 (1110), even though fewer in number than q bits, are added to sum 507 to generate sum 509 (11101111). This sum has greater than q bits. Therefore, the first q bits 510 (1101111) are summed with the next q bits 511 (in this case, the single bit 1), to generate sum 512 (1110000). This sum, having q or fewer bits, is the solution to n (mod p). 1110000=26 +25 +24 =64+32+16=112.
Thus, the solution 112 to n mod 127 is determined using only shifts and adds when an elliptic curve over a field of Mersenne primes is used. The use of Mersenne primes in conjunction with elliptic curve cryptosystems eliminates explicit divisions.
EXAMPLE 3
Fermat Number (mod p) Arithmetic
In the present invention, when p is a Fermat number where p=2q +1, the (mod p) arithmetic can be accomplished using only shifts, adds, and subtracts (a negative add), with no division required. Consider again n (mod p) where n is 3,991,652,149 and where p is now 257. When p is 257, q is equal to 8, from p=2q +1; 257=28+ 1=256+1=257.
The (mod p) arithmetic can be accomplished by using the binary form of n, namely 11101101111010111100011100110101. Referring to FIG. 6, the shifts and adds are accomplished by first latching the q (8) least significant bits (LSB's) 601 (00110101). The next q LSB's 602 of the remaining digits, namely 11000111, are to be subtracted from q digits 601. To accomplish this, the 1's complement of bits 602 is generated and a 1 is added to the MSB side to indicate a negative number, resulting in bits 602' (100111000). This negative number 602' is added to bits 601 to generate result 603 (101101101). The next q LSB's 604 of n, (11101011), are added to sum 603, generating result 605, (1001011000). Bits 606 of n (11101101) are to be subtracted from result 605. Therefore, the 1's complement of bits 606 is generated and a negative sign bit of one is added on the MSB side to generate bits 606' (100010010). Bits 606' is added to result 605, to generate sum 607, (1101101010).
Sum 607 has more than q bits so the q LSB's are latched as bits 608 (01101010). The next q bits (in this case, only two bits, 11) are added to bits 608, generating sum 610 (01101101). This sum, having q or fewer bits, is the solution to n (mod p). 01101101=26 +25 +23 +22 +20 =64+32+8+4+1=109.
EXAMPLE 4
Fast Class mod arithmetic
In the present invention, when p is a number of the class p=2q -C, where C is and odd number and is relatively small, (e.g. no greater than the length of a digital word), the (mod p) arithmetic can be accomplished using only shifts and adds, with no division required. Consider again n (mod p) where n is 685 and where p is 13. When p is 13, q is equal to 4 and C is equal to 3, from p=2q -C; 13=24 -3=16-3=13.
The (mod p) arithmetic can be accomplished by using the binary form of n, namely 1010101101. Referring to FIG. 7, the shifts and adds are accomplished by first latching the q (4) least significant bits (LSB's) 701 of n, namely 1101. The remaining bits 702 (101010) are multiplied by C (3) to generate product 703 (1111110). Product 703 is added to bits 701 to generate sum 704 (10001011). The q least significant bits 705 (1011) of sum 704 are latched. The remaining bits 706 (1000) are multiplied by C to generate product 707 (11000). Product 707 is added to bits 705 to generate sum 708 (100011). The q least significant bits 709 (0011) of sum 708 are latched. The remaining bits 710 (10) are multiplied by C to generate product 711 (110). Product 711 is added to bits 709 to generate sum 712 (1001). Sum 712, having q or fewer bits, is the solution to n (mod p). 1001=23 +20 =8+1=9. 685 divided by 13 results in a remainder of 9. The fast class arithmetic provides the solution using only shifts, adds, and multiplies.
Shift and Add Implementation
Fast Mersenne mod operations can be effected via a well known shift procedure. For p=2q -1 we can use:
x=(x&p)+(x>>q)                                             Equation (17)
a few times in order to reduce a positive x to the appropriate residue value in the interval 0 through p-1 inclusive. This procedure involves shifts and add operations only. Alternatively, we can represent any number x (mod p) by:
x=a+b2(q+1)/2=(a, b)                                       Equation (18)
If another integer y be represented as (c, d), we have:
xy (mod p)=(ac+2bd, ad+bc)                                 Equation (19)
after which some trivial shift-add operations may be required to produce the correct reduced residue of xy.
To compute an inverse (mod p), there are at least two ways to proceed. One is to use a binary form of the classical extended-GCD procedure. Another is to use a relational reduction scheme. The relational scheme works as follows:
Given p=2q -1, x≠0 (mod p), to return x-1 (mod p):
1) Set (a, b)=(1, 0) and (y, z)=(x, p);
2) If (y==0) return(z);
3) Find e such that 2e //y;
4) Set a=2q-e a (mod p);
5) If(y==1) return(a);
6) Set (a, b)=(a+b, a-b) and (y, z)=(y+z, y-z);
7) Go to (2).
The binary extended-GCD procedure can be performed without explicit division via the operation [a/b]2, defined as the greatest power of 2 not exceeding a/b:
Given p, and x≠0 (mod p), to return x-1 (mod p):
1) If (x==1) return(1);
2) Set (x, v0)=(0, 1) and (u1, v1)=(p, x);
3) Set u0 =[u1 /v1 ]2;
4) Set (x, v0)=(v0, x-u0 v0) and (u1, v1)=(v1, u1 -u0 v1);
5) If (v1 ==0) return(x); else go to (3).
The present invention may be implemented on any conventional or general purpose computer system. An example of one embodiment of a computer system for implementing this invention is illustrated in FIG. 4. A keyboard 410 and mouse 411 are coupled to a bi-directional system bus 419. The keyboard and mouse are for introducing user input to the computer system and communicating that user input to CPU 413. The computer system of FIG. 4 also includes a video memory 414, main memory 415 and mass storage 412, all coupled to bi-directional system bus 419 along with keyboard 410, mouse 411 and CPU 413. The mass storage 412 may include both fixed and removable media, such as magnetic, optical or magnetic optical storage systems or any other available mass storage technology. The mass storage may be shared on a network, or it may be dedicated mass storage. Bus 419 may contain, for example, 32 address lines for addressing video memory 414 or main memory 415. The system bus 419 also includes, for example, a 32-bit data bus for transferring data between and among the components, such as CPU 413, main memory 415, video memory 414 and mass storage 412. Alternatively, multiplex data/address lines may be used instead of separate data and address lines.
In the preferred embodiment of this invention, the CPU 413 is a 32-bit microprocessor manufactured by Motorola, such as the 68030 or 68040. However, any other suitable microprocessor or microcomputer may be utilized. The Motorola microprocessor and its instruction set, bus structure and control lines are described in MC68030 User's Manual, and MC68040 User's Manual, published by Motorola Inc. of Phoenix, Ariz.
Main memory 415 is comprised of dynamic random access memory (DRAM) and in the preferred embodiment of this invention, comprises 8 megabytes of memory. More or less memory may be used without departing from the scope of this invention. Video memory 414 is a dual-ported video random access memory, and this invention consists, for example, of 256 kbytes of memory. However, more or less video memory may be provided as well.
One port of the video memory 414 is coupled to video multiplexer and shifter 416, which in turn is coupled to video amplifier 417. The video amplifier 417 is used to drive the cathode ray tube (CRT) raster monitor 418. Video multiplexing shifter circuitry 416 and video amplifier 417 are well known in the art and may be implemented by any suitable means. This circuitry converts pixel data stored in video memory 414 to a raster signal suitable for use by monitor 418. Monitor 418 is a type of monitor suitable for displaying graphic images, and in the preferred embodiment of this invention, has a resolution of approximately 1020×832. Other resolution monitors may be utilized in this invention.
The computer system described above is for purposes of example only. The present invention may be implemented in any type of computer system or programming or processing environment.
Block Diagram
FIG. 8 is a block diagram of the present invention. A sender, represented by the components within dashed line 801, encrypts a plaintext message Ptxt to a ciphertext message C. This message C is sent to a receiver, represented by the components within dashed line 802. The receiver 802 decrypts the ciphertext message C to recover the plaintext message Ptxt.
The sender 801 comprises an encryption/decryption means 803, an elliptic multiplier 805, and a private key source 807. The encryption/decryption means 803 is coupled to the elliptic multiplier 805 through line 809. The elliptic multiplier 805 is coupled to the private key source 807 through line 811.
The encryption/decryption means 804 of receiver 802 is coupled to elliptic multiplier 806 through line 810. The elliptic multiplier 806 is coupled to the private key source 808 through line 812.
The private key source 807 of the sender 801 contains the secure private password of the sender, "ourPri". Private key source 807 may be a storage register in a computer system, a password supplied by the sender to the cryptosystem when a message is sent, or even a coded, physical key that is read by the cryptosystem of FIG. 8 when a message is sent or received. Similarly, the private key source 808 of receiver 802 contains the secure private password of the receiver, namely, "theirPri".
A separate source 813 stores publicly known information, such as the public keys "ourPub" and "theirPub" of sender 801 and receiver 802, the initial point (x1, y1), the field F.sbsb.pk, and curve parameter "a". This source of information may be a published directory, an on-line source for use by computer systems, or it may transmitted between sender and receiver over a non-secure transmission medium. The public source 813 is shown symbolically connected to sender 801 through line 815 and to receiver 802 through line 814.
In operation, the sender and receiver generate a common one time pad for use as an enciphering and deciphering key in a secure transmission. The private key of the sender, ourPri, is provided to the elliptic multiplier 805, along with the sender's public key, theirPub. The elliptic multiplier 805 computes an enciphering key eK from (ourPri)°(theirPub) (mod p). The enciphering key is provided to the encryption/decryption means 803, along with the plaintext message Ptxt. The enciphering key is used with an encrypting scheme, such as the DES scheme or the elliptic curve scheme of the present invention, to generate a ciphertext message C. The ciphertext message is transmitted to the receiver 802 over a nonsecure channel 816.
The receiver 802 generates a deciphering key DK using the receiver's private key, theirPri. TheirPri is provided from the private key source 808 to the elliptic multiplier 804, along with sender's public key, ourPub, (from the public source 813). Deciphering key DK is generated from (theirPri)°(ourPub) (mod p). The deciphering key DK is equal to the enciphering key eK due to the abelian nature of the elliptic multiplication function. Therefore, the receiver 802 reverses the encryption scheme, using the deciphering key DK, to recover the plaintext message Ptxt from the ciphertext message C.
The encryption/decryption means and elliptic multiplier of the sender 801 and receiver 802 can be implemented as program steps to be executed on a microprocessor.
Inversionless Parameterization
The use of fast class numbers eliminates division operations in (mod p) arithmetic operations. However, as illustrated by equations 13-16 above, the elliptic multiply operation "°" requires a number of division operations to be performed. The present invention reduces the number of divisions required for elliptic multiply operations by selecting the initial parameterization to be inversionless. This is accomplished by selecting the initial point so that the "Y" terms are not needed.
In the present invention, both sender and recipient generate a mutual one-time pad, as a particular x-coordinate on the elliptic curve. By choosing the initial point (X1, Y1) appropriately, divisions in the process of establishing multiples n°(X1, Y1) are eliminated. In the steps that follow, the form
n°(X.sub.m /Z.sub.m)                                Equation (20)
for integers n, denotes the coordinate (Xn+m /Zn+m). For x=X/Z the x-coordinate of the multiple n(x, y) as Xn /Zn, is calculated using a "binary ladder" method in accordance with the adding-doubling rules, which involve multiply mod operations:
If i≠j:
X.sub.i+j =Z.sub.i-j (X.sub.i X.sub.j -Z.sub.i Z.sub.j).sup.2Equation (21)
Z.sub.i+j =X.sub.i-j (X.sub.i Z.sub.j -Z.sub.i X.sub.j).sup.2Equation (22)
Otherwise, if i=j:
X.sub.2i =(X.sub.i.sup.2 -Z.sub.i.sup.2).sup.2             Equation (23)
Z.sub.2i =4X.sub.i Z.sub.i (X.sub.i.sup.2 +a X.sub.i Z.sub.i +Z.sub.i.sup.2)Equation (24)
These equations do not require divisions, simplifying the calculations when the present invention is implemented in the present preferred embodiment. This is referred to as "Montgomery parameterization" or "inversionless parameterization" (due to the absence of division operations), and is described in "Speeding the Pollard and Elliptic Curve Methods of Factorization" Montgomery, P. 1987 Math. Comp., 48 (243-264). When the field is simply Fp this scheme enables us to compute multiples nx via multiplication, addition, and (rapid) Mersenne mod operations. This also holds when the field is Fp 2. Because p=3 (mod 4) for any Mersenne prime p, we may represent any Xi or Zi as a complex integer, proceeding with complex arithmetic for which both real and imaginary post-multiply components can be reduced rapidly (mod p). We also choose Z1 =1, so that the initial point on the curve is (X1 /1, y) where y will not be needed.
Using both fast class numbers and inversionless parameterization, a public key exchange using the method of the present invention can proceed as follows. In the following example, the prime is a Mersenne prime. However, any of the fast class numbers described herein may be substituted.
1) At "our" end, use parameter a, to compute a public key: ourPub ε F.sbsb.pk
(X/Z)=ourPri°(X1 /1)
ourPub=XZ-1
2) At "their" end, use parameter a, to compute a public key: theirPub ε F.sbsb.pk
(X/Z)=theirPri°(X1 /1)
theirPub=XZ-1
3) The two public keys ourPub and theirPub are published, and therefore are known.
4) Compute a one-time pad: ourPad ε F.sbsb.pk
(X/Z)=ourPri°(theirPub/1)
ourPad=XZ-1
5) Compute a one-time pad: theirPad ε F.sbsb.pk
(X/Z)=theirPri°(ourPub/1)
theirPad=XZ-1
The usual key exchange has been completed, with
ourPad=theirPad
Message encryption/decryption between "our" end and "their" end may proceed according to this mutual pad.
FFT Multiply
For very large exponents, such as q>5000, it is advantageous to perform multiplication by taking Fourier transforms of streams of digits. FFT multiply works accurately, for example on a 68040-based NeXTstation, for general operations xy (mod p) where p=2q -1 has no more than q=220 (about one million) bits. Furthermore, for Mersenne p there are further savings when one observes that order-q cyclic convolution of binary bits is equivalent to multiplication (mod 2q -1). The use of FFT multiply techniques results in the ability to perform multiply-mod in a time roughly proportional to q log q, rather than q2.
Elliptic curve algebra can be sped up intrinsically with FFT techniques. Let X denote generally the Fourier transform of the digits of X, this transform being the same one used in FFT multiplication. Then we can compute coordinates from equations 21-24. To compute Xi+j for example, we can use five appropriate transforms, (Xi, Xj, Zi, Zj, and Zi-j) (some of which can have been stored previously) to create the transform:
X.sub.i+j =Z.sub.i-j (X.sub.i X.sub.j -Z.sub.i Z.sub.j).sup.2
In this way the answer Xi+j can be obtained via 7 FFT's. (Note that the usual practice of using 2 FFT's for squaring and 3 FFT's for multiplication results in 11 FFT's for the "standard" FFT approach). The ratio 7/11 indicates a significant savings for the intrinsic method. In certain cases, such as when p is a Mersenne prime and one also has an errorless number-theoretic transform available, one can save spectra from the past and stay in spectral space for the duration of long calculations; in this way reducing times even further.
A flow diagram illustrating the operation of the present invention when using fast class numbers, inversionless parameterization and FFT multiply operations is illustrated in FIG. 9. At step 901, a fast class number p is chosen where p=2q -C. The term q is the bit depth of the encryption scheme. The greater the number of bits, the greater the security. For large values of q, FFT multiply operations are used to calculate p. The term p is made publicly available.
At step 902, the element k for the field F.sbsb.pk is chosen and made public. At step 903, an initial point (X1 /Z) on the elliptic curve is selected. By selecting the initial point to be inversionless, costly divides are avoided. The initial point is made public. The curve parameter a is chosen at step 904 and made public.
At step 905, the sender computes X1 /Z=ourPri°(X1 /1) using inversionless parameterization. The sender's public key is generated ourPub=(XZ-1)(mod p). The receiver's public key theirPub=(XZ-1)(mod p), is generated at step 906.
A one time pad for the sender, ourPad, is generated at step 907. X/Z=(ourPri)°(theirPub/1). ourPad=XZ-1 (mod p). At step 908, a one time pad for the receiver, theirPad, is generated. X/Z=(theirPri)°(ourPub/1). theirPad=XZ-1 (mod p). The calculation of ourPad and theirPad utilizes FFT multiplies to eliminate the need to calculate the inversion Z-1. At step 909, the sender converts a plaintext message Ptxt to a ciphertext message C using ourPad. The ciphertext message C is transmitted to the receiver. At step 910, the receiver recovers the plaintext message Ptxt by deciphering the ciphertext message C using theirPad.
FEE Security
The algebraic factor M89 =289 -1, which is a Mersenne prime, occurs with "natural" statistics when the elliptic curve method (ECM) was employed. This was shown in attempts to complete the factorization of M445 =2445 -1 (this entry in the Cunningham Table remains unresolved as of this writing). In other words, for random parameters a the occurrence k(X1 /1)=O for elliptic curves over Fp with p=M89 was statistically consistent with the asymptotic estimate that the time to find the factor M89 of M445 be O(exp(√ (2 log p log log p)). These observations in turn suggested that finding the group order over Fp is not "accidentally" easier for Mersenne primes p, given the assumption of random a parameters.
Secondly, to check that the discrete logarithm problem attendant to FEE is not accidentally trivial, it can be verified, for particular a parameters, that for some bounded set of integers N
(p.sup.N -1) (X.sub.1 /1)≠O
The inequality avoids the trivial reduction of the discrete logarithm evaluation to the equivalent evaluation over a corresponding finite field. Failures of the inequality are extremely rare, in fact no non-trivial instances are known at this time for q>89.
The present invention provides a number of advantages over prior art schemes, particularly factoring schemes such as the RSA scheme. The present invention can provide the same security with fewer bits, increasing speed of operation. Alternatively, for the same number of bits, the system of the present invention provides greater security.
Another advantage of the present cryptosystem over prior art cryptosystems is the distribution of private keys. In prior art schemes such as RSA, large prime numbers must be generated to create private keys. The present invention does not require that the private key be a prime number. Therefore, users can generate their own private keys, so long as a public key is generated and published using correct and publicly available parameters p, F.sbsb.pk, (X1 /Z) and "a". A user cannot generate its own private key in the RSA system.
DIGITAL SIGNATURE
The present invention provides an improved method for creating and authenticating a digital signature that uses the elliptic algebra described above and a hashing or digesting function. The sender has prepared an encrypted message "ciphertext". This message may be encrypted as described above or may be encrypted using any other encryption scheme. The sender then creates a digital signature to append to the message as a way of "signing" the message. The signature scheme of the preferred embodiment is described below, followed by the method of reducing computations.
Creation of Signature
Assume a curve parameterized by a, with starting point (X1 /1). The sender's public key ourPub is generated as the multiple ourPri°(x1 /1), where ourPri is our private key (an integer) and ° is multiplication on the elliptic curve. The digital signature is created as follows:
1) Choose a random integer m of approximately q bits.
2) Compute the point
P=m°(X.sub.1 /1).
3) Using a message digest function M, compute the integer
u=m+our Pri*M(ciphertext, P)
where ciphertext is the encrypted message to be sent.
4) Along with the ciphertext, transmit the digital signature as the pair (u, P). Note that u is an integer of about 2q bits, while P is a point on the curve.
In the preferred embodiment of the present invention, a message digesting function M such as MD2 or MD5 is used as part of the creation of the digital signature. However, the present invention may be implemented using other digesting functions or by using any suitable hashing function.
AuthenticatiOn of Digital Signature
The receiver attempts to authenticate the signature by generating a pair of points to match the digital signature pair, using the ciphertext message and the public key of the purported sender. The receiver verifies the signature using the following steps:
1) Using the u part of the signature, compute the point
Q=u°(X.sub.1 /1)
2) Compare the point Q to the point
R=P+M(ciphertext, P)°ourPub
The signature is invalid if these elliptic points Q and R do not compare exactly. In other words, if the signature is authentic, the following must hold:
u°(X.sub.1 /1)=P+M(ciphertext, P)°ourPub
Substituting for u on the left side of the equation above gives:
(m+our Pri*M(ciphertext, P))°(X.sub.1 /1)=P+M(ciphertext, P)°ourPub
or:
m°(X.sub.1 /1)+(ourPri*M(ciphertext, P))°(X.sub.1 /1)=P+M(ciphertext, P)°ourPub
Substituting for ourPub on the right side of the equation yields:
m°(X.sub.1 /1)+(ourPri*M(ciphertext, P))°(X.sub.1 /1)=P+M(ciphertext, P)°ourPri°(X.sub.1 /1)
Since P=m°(X1 /1) from above, the left side becomes:
P+(ourPri*M(ciphertext, P))°(X.sub.1 /1)=P+M(ciphertext, P)°ourPri°(X.sub.1 /1)
Moving ourPri in the right side of the equation gives:
P+ourPri*M(ciphertext, P))°(X.sub.1 /1)=P+ourPri*M(ciphertext, P)°(X.sub.1 /1)
Thus, a point on a curve is calculated via two different equations using the transmitted pair (u, P). It can be seen that by calculating Q from the transmitted point u, and by calculating R from transmitted point P, the ciphertext message, and the public key of the purported sender, the digital signature is assumed authenticated when Q and R match.
Security
The digital signature scheme of this scheme is secure on the basis of the following observation. To forge a signature one would need to find a pair (u, P) and a ciphertext that satisfy the equation
u°(X.sub.1 /1)=P+M(ciphertext, P)°ourPub
This would either entail an elliptic logarithm operation (the basis of the encryption security of the present invention) or breaking of the hash function M.
Optimizing Authentication
The recipient's final step in the digital signature scheme of the present invention involves the addition of two points; namely P and M(ciphertext, P)°ourPub to yield R and comparing that sum to a point Q. One could perform the elliptic addition using specified y-coordinates at each step. The scheme of the present invention provides a method of deducing the possible values of the x-coordinate of a sum of two points, using only the respective x-coordinates of the original two points in question. Using this method one may rapidly perform a necessity check on whether the points Q and the sum of P+M(ciphertext, P)°ourPub have identical x-coordinates.
A principle for fast verification of sums, using only x-coordinates, runs as follows. Let the curve be
By.sup.2 =x.sup.3 +Ax.sup.2 +x
Theorem: Let P1 =(x1, y1), P2 =((x2, y2), and Q=(x, y) be three points on a given curve, with x1 ≠x2, Then
P.sub.1 +P.sub.2 =Q
only if
x(c-x)=b.sup.2
where
b=(x.sub.1 x.sub.2 -1)/(x.sub.1 -x.sub.2)
C=2{(x.sub.1 x.sub.2 +1) (x.sub.1 +x.sub.2 +2A)-[2A]/(x.sub.1 -x.sub.2).sup.2
The proof is given as follows. Not knowing the y-coordinates of P1 and P2, the only possibilities for the x-coordinate of the sum P1 +P2 are, for any fixed pair (y1, t2), the respective x-coordinates (call them e,f)) of the two forms (x1,y1)+(x2, y2). One can compute:
ef=b.sup.2
e+f=c
as in Montgomery, supra. Since x is one or the other of e,f it is necessary that (x-e)(x-f)=0, whence the quadratic equation of the theorem holds.
Therefore, the quadratic equation (x-e)(x-f)=0 will generally have two solutions. One solution corresponds to an authentic signature. The other solution is extremely unlikely to have been selected at random, because the pool of x coordinates is of a size comparable to the elliptic curve. Therefore, when (x-e)(x-f)=0 is satisfied, it can be safely assumed that the signature is authentic.
In practical application, P1 represents the calculated point P that is sent as part of the signature by the sender. P2 represents the expression M(ciphertext, P)°ourPub. Q of course represents u°(X1 /1). P1 +P2 represents R and is compared to Q.
Flow Diagrams
FIG. 10 is a flow diagram illustrating the generation of a digital signature using the present invention. At step 1001, the sender chooses a random integer m. This random integer can be generated using a suitable random number generator for use with a microprocessor. At step 1002 a point P is calculated using m. As noted above, this point is generated using the relation P=m°(X1 /1). in the preferred embodiment of the present invention. However, other schemes may be used for generating point P without departing from the scope of the present invention.
At step 1003, a second point, u, is calculated using m, P, ourPri, and the ciphertext message. In the preferred embodiment of the invention, this is generated using the relationship u=m+our Pri * M(ciphertext, P). As noted above, hashing functions other than digesting functions MD2 and MD5 can be used. In addition, other relationships can be used to calculate u. It is recommended that if other relationships are used, that m, P, ourPri and the ciphertext message be used. At step 1004, the calculated pair (u, P) is sent as a digital signature.
FIG. 11 is a flow diagram illustrating the authentication of a digital signature in the present invention. At step 1101 the recipient of the message recieves the digital signature (u, P) and the ciphertext message. At step 1102 the point Q is generated using the point u. In the preferred embodiment, the relationship Q=u°(X1 /1) is used to generate Q. Other relationships may be used depending on what relationships were used to calculate u, P by the sender.
At step 1103 a point P2 is generated using ourPub and the ciphertext message. In the preferred embodiment, the relationship M(ciphertext, P)°ourPub is used to generate P2. Other relationships may be used depending on what relationships were used to calculate u, P by the sender.
At step 1104 the x values of P1 and P2 are used to determine values b and c and ultimately, e and f. This leads to to possible x values for the sum of P1 and P2. At decision block 1105 the argument "e,f=x?" is made to determine if either of the possible x values satisfies the equality of P1 +P2 =Q. If neither of the calculated x values satisfy the equation, that is, if the argument at decision block 1105 is false, the signature is not authentic and is indicated at block 1106. If one of the x values does satisfy the equation, that is, if the argument at decision block 1105 is true, a valid signature is assumed and indicated at block 1107.
Block Diagram
FIG. 12 illustrates a block diagram for implementing the digital signature scheme of the present invention. Where elements of FIG. 12 are in common with elements of FIG. 8, the same element numbers are used. The signature scheme is shown in use with an encryption scheme that uses elliptic multiplication, but this is by way of example only. The present invention can be used with any type of encryptions scheme.
A sender, represented by the components within dashed line 1201, encrypts a plaintext message Ptxt to a ciphertext message C and generates a signature (u, P). This message C and signature (u, P) is sent to a receiver, represented by the components within dashed line 1202. The receiver 1202 decrypts the ciphertext message C to recover the plaintext message, and authenticates the signature (u, P).
The sender 1201 comprises an encryption/decryption means 1203, an elliptic multiplier 805, a random number generator 1205, a hasher 1207, and a private key source 807. The encryption/decryption means 1203 is coupled to the elliptic multiplier 805 through line 809. The elliptic multiplier 805 is coupled to the private key source 807 through line 811. The random number generator 1205 provides random number rn on line 1209 to elliptic multiplier 805 and to hasher 1207. Elliptic multiplier 805 provides point u to the nonsecure channel 816 via line 1211. The encrypted ciphertext C is provided to hasher 1207 via line 1213. Hasher 1207 provides point P to nonsecure channel 816 via line 1215.
The encryption/decryption means 1204 of receiver 1202 is coupled to elliptic multiplier 806 through line 810. The elliptic multiplier 806 is coupled to the private key source 808 through line 812. The point u is provided to the elliptic multiplier 806 from the nonsecure channel 816 via line 1212. Elliptic multiplier 806 generates point Q and provides it to comparator 1208 via line 1216. Hasher 1206 recieves the ciphertext message C and point P from nonsecure channel 816 via line 1210, and ourPub from source 813 via line 1218. Hasher 1206 outputs point R to comparator 1208 via line 1214.
The private key source 807 of the sender 801 contains the secure private password of the sender, "ourPri". Private key source 807 may be a storage register in a computer system, a password supplied by the sender to the cryptosystem when a message is sent, or even a coded, physical key that is read by the cryptosystem of FIG. 12 when a message is sent or received. Similarly, the private key source 808 of receiver 802 contains the secure private password of the receiver, namely, "theirPri".
A separate source 813 stores publicly known information, such as the public keys "ourPub"and "theirPub" of sender 1201 and receiver 1202, the initial point (x1, y1), the field F.sbsb.pk, and curve parameter "a". This source of information may be a published directory, an on-line source for use by computer systems, or it may transmitted between sender and receiver over a non-secure transmission medium. The public source 813 is shown symbolically connected to sender 1201 through line 815 and to receiver 1202 and hasher 1206 through lines 814 and 1218 respectively.
In operation, the sender and receiver generate a common one time pad for use as an enciphering and deciphering key in a secure transmission, as described above. The enciphering key is provided to the encryption/decryption means 1203, along with the plaintext message. The enciphering key is used with an encrypting scheme, such as the DES scheme or the elliptic curve scheme of the present invention, to generate a ciphertext message C. The random number generator 1205 generates random number m and provides it to elliptic multiplier 805. Elliptic multiplier 805 generates point u and provides it to the receiver via nonsecure channel 816. The ciphertext message C is provided to the hasher 1207, along with the random number m and ourPri. Hasher 1207 generates point P and provides it to nonsecure channel 816. The ciphertext message, along with signature (u, P), is transmitted to the receiver 1202 over a nonsecure channel 816.
The receiver 1202 generates a deciphering key DK using the receiver's private key, theirPri. TheirPri is provided from the private key source 808 to the elliptic multiplier 806, along with sender's public key, ourPub, (from the public source 813). Deciphering key DK is generated from (theirPri)°(ourPub) (mod p). The deciphering key DK is equal to the enciphering key eK due to the abelian nature of the elliptic multiplication function. Therefore, the receiver 1202 reverses the encryption scheme, using the deciphering key DK, to recover the plaintext message from the ciphertext message C.
The elliptic multiplier 806 of the receiver 1202 receives point u from the nonsecure channel 816. The elliptic multiplier 806 generates point Q and provides it to comparator 1208. Hasher recieves the ciphertext message C and point P from the nonsecure channel 816 and the purported senders public key ourPub from source 813 and generates point R, which it provides to comparator 1208. Comparator 1208 compares points Q and R and if they match, the signature is assumed to be valid. In the present invention, the comparison of points Q and R is accomplished using the optimized scheme using x values described above.
The encryption/decryption means and elliptic multiplier of the sender 1201 and receiver 1202 can be implemented as program steps to be executed on a microprocessor.
Code
A function to compare signatures using the optimized scheme is as follows:
______________________________________                                    
int                                                                       
signature.sub.-- compare(key p1, key p2, key p3);                         
/* Returns non-zero if x(p1) cannot be the x-coordinate of the            
sum of two points whose respective x-coordinates are x(p2),               
x(p3). */                                                                 
______________________________________                                    
A function to calculate Q and compare it with (P+M(ciphertext, P)°ourPub) is as follows:
______________________________________                                    
q = new.sub.-- public.sub.-- from.sub.-- private (NULL, depth, seed);     
elliptic.sub.-- mul (q, u); /* u is the random integer. */                
elliptic.sub.-- mul (our, m); /* m = M(cipertext, P). */                  
/* Next, use the transmitted point p. */                                  
if(signature.sub.-- compare (p, our, q))                                  
 fprintf(stderr,"Signature invalid.\n");                        
______________________________________                                    
Encryption/Decryption
The encryption/decryption schemes of the present invention can be implemented in the programming language C. The following are examples of programmatic interfaces (.h files) and test programs (.c files) suitable for implementing the encryption/decryption of the present invention. ##SPC1##

Claims (1)

I claim:
1. A method for creating and authenticating a digital signature comprising the steps of:
in a sender computer system;
generating a random integer m;
using m, generating a point P1 having coordinates (X1, Y1);
using m and P1, generating a point u;
sending the pair (u, P1) as a digital signature to a receiver computer system;
in said reciever computer system;
using u, generating a point Q having coordinates (X, Y);
using P1, generating a point P2 having coordinates (X2, Y2);
without using Y1 and Y2, testing the equality P1 +P2 =Q;
identifying a signature as not authentic when the equality P1 +P2 =Q is not satisfied.
US08/484,264 1991-09-17 1995-06-07 Method and apparatus for digital signature authentication Expired - Lifetime US5581616A (en)

Priority Applications (7)

Application Number Priority Date Filing Date Title
US08/484,264 US5581616A (en) 1991-09-17 1995-06-07 Method and apparatus for digital signature authentication
US08/758,688 US5805703A (en) 1991-09-17 1996-11-27 Method and apparatus for digital signature authentication
US08/896,993 US6307935B1 (en) 1991-09-17 1997-07-18 Method and apparatus for fast elliptic encryption with direct embedding
US09/149,876 US6049610A (en) 1991-09-17 1998-09-09 Method and apparatus for digital signature authentication
US09/544,530 US6285760B1 (en) 1991-09-17 2000-04-06 Method and apparatus for digital signature authentication
US09/946,967 US6751318B2 (en) 1991-09-17 2001-09-04 Method and apparatus for digital signature authentication
US10/857,250 US7603560B2 (en) 1991-09-17 2004-05-27 Method and apparatus for digital signature authentication

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
US07/761,276 US5159632A (en) 1991-09-17 1991-09-17 Method and apparatus for public key exchange in a cryptographic system
US07/955,479 US5271061A (en) 1991-09-17 1992-10-02 Method and apparatus for public key exchange in a cryptographic system
US08/167,408 US5463690A (en) 1991-09-17 1993-12-14 Method and apparatus for public key exchange in a cryptographic system
US08/484,264 US5581616A (en) 1991-09-17 1995-06-07 Method and apparatus for digital signature authentication

Related Parent Applications (2)

Application Number Title Priority Date Filing Date
US08/167,408 Continuation-In-Part US5463690A (en) 1991-09-17 1993-12-14 Method and apparatus for public key exchange in a cryptographic system
US08/167,408 Continuation US5463690A (en) 1991-09-17 1993-12-14 Method and apparatus for public key exchange in a cryptographic system

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US08/758,688 Continuation US5805703A (en) 1991-09-17 1996-11-27 Method and apparatus for digital signature authentication

Publications (1)

Publication Number Publication Date
US5581616A true US5581616A (en) 1996-12-03

Family

ID=27116957

Family Applications (8)

Application Number Title Priority Date Filing Date
US07/955,479 Expired - Lifetime US5271061A (en) 1991-09-17 1992-10-02 Method and apparatus for public key exchange in a cryptographic system
US08/167,408 Expired - Lifetime US5463690A (en) 1991-09-17 1993-12-14 Method and apparatus for public key exchange in a cryptographic system
US08/484,264 Expired - Lifetime US5581616A (en) 1991-09-17 1995-06-07 Method and apparatus for digital signature authentication
US08/758,688 Expired - Lifetime US5805703A (en) 1991-09-17 1996-11-27 Method and apparatus for digital signature authentication
US09/149,876 Expired - Lifetime US6049610A (en) 1991-09-17 1998-09-09 Method and apparatus for digital signature authentication
US09/544,530 Expired - Lifetime US6285760B1 (en) 1991-09-17 2000-04-06 Method and apparatus for digital signature authentication
US09/946,967 Expired - Fee Related US6751318B2 (en) 1991-09-17 2001-09-04 Method and apparatus for digital signature authentication
US10/857,250 Expired - Fee Related US7603560B2 (en) 1991-09-17 2004-05-27 Method and apparatus for digital signature authentication

Family Applications Before (2)

Application Number Title Priority Date Filing Date
US07/955,479 Expired - Lifetime US5271061A (en) 1991-09-17 1992-10-02 Method and apparatus for public key exchange in a cryptographic system
US08/167,408 Expired - Lifetime US5463690A (en) 1991-09-17 1993-12-14 Method and apparatus for public key exchange in a cryptographic system

Family Applications After (5)

Application Number Title Priority Date Filing Date
US08/758,688 Expired - Lifetime US5805703A (en) 1991-09-17 1996-11-27 Method and apparatus for digital signature authentication
US09/149,876 Expired - Lifetime US6049610A (en) 1991-09-17 1998-09-09 Method and apparatus for digital signature authentication
US09/544,530 Expired - Lifetime US6285760B1 (en) 1991-09-17 2000-04-06 Method and apparatus for digital signature authentication
US09/946,967 Expired - Fee Related US6751318B2 (en) 1991-09-17 2001-09-04 Method and apparatus for digital signature authentication
US10/857,250 Expired - Fee Related US7603560B2 (en) 1991-09-17 2004-05-27 Method and apparatus for digital signature authentication

Country Status (1)

Country Link
US (8) US5271061A (en)

Cited By (39)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5805703A (en) * 1991-09-17 1998-09-08 Next Software, Inc. Method and apparatus for digital signature authentication
WO1999030458A1 (en) * 1997-12-05 1999-06-17 Secured Information Technology, Inc. Transformation methods for optimizing elliptic curve cryptographic computations
US5933504A (en) * 1995-05-18 1999-08-03 Certicom Corp. Strengthened public key protocol
US6163841A (en) * 1998-06-23 2000-12-19 Microsoft Corporation Technique for producing privately authenticatable cryptographic signatures and for authenticating such signatures
US6209093B1 (en) 1998-06-23 2001-03-27 Microsoft Corporation Technique for producing a privately authenticatable product copy indicia and for authenticating such an indicia
US6212281B1 (en) * 1996-10-11 2001-04-03 Certicom Corp. Digital signature protocol
US6243467B1 (en) 1998-07-23 2001-06-05 The United States Of America As Represented By The National Security Agency Method of elliptic curve cryptographic digital signature generation and verification using reduced base tau expansion in non-adjacent form
US6279110B1 (en) 1997-11-10 2001-08-21 Certicom Corporation Masked digital signatures
US20020021810A1 (en) * 2000-08-18 2002-02-21 Solinas Jerome Anthony Cryptographic key exchange method using efficient elliptic curve
US20020021803A1 (en) * 2000-08-18 2002-02-21 Solinas Jerome Anthony Cryptographic identification and digital signature method using efficient elliptic curve
US20020025034A1 (en) * 2000-08-18 2002-02-28 Solinas Jerome Anthony Cryptographic encryption method using efficient elliptic curve
US20030081785A1 (en) * 2001-08-13 2003-05-01 Dan Boneh Systems and methods for identity-based encryption and related cryptographic techniques
US20040001455A1 (en) * 2000-03-24 2004-01-01 Smarttrust Systems Oy Method and system for identification of digitally signed messages in a telecommunication system
US20040098589A1 (en) * 2002-11-14 2004-05-20 Identicrypt, Inc. Identity-based encryption system
US20040179684A1 (en) * 2003-03-14 2004-09-16 Identicrypt, Inc. Identity-based-encryption messaging system
US20050010801A1 (en) * 2003-06-25 2005-01-13 Terence Spies Identity-based-encryption messaging system with public parameter host servers
US20050071632A1 (en) * 2003-09-25 2005-03-31 Pauker Matthew J. Secure message system with remote decryption service
US20050084100A1 (en) * 2003-10-17 2005-04-21 Terence Spies Identity-based-encryption system with district policy information
US20050138353A1 (en) * 2003-12-22 2005-06-23 Terence Spies Identity-based-encryption message management system
US7003117B2 (en) 2003-02-05 2006-02-21 Voltage Security, Inc. Identity-based encryption system for secure data distribution
US7020282B1 (en) * 2000-09-05 2006-03-28 Chung Nan Chang Simplified secure, swift cryptographic key exchange
US7024559B1 (en) 2002-06-28 2006-04-04 The United States Of America As Represented By The National Security Agency Method of elliptic curve digital signature using expansion in joint sparse form
US7062043B1 (en) 2002-06-28 2006-06-13 The United States Of America As Represented By The National Security Agency Method of elliptic curve digital signature using coefficient splitting
US20060174126A1 (en) * 2005-02-03 2006-08-03 Crandall Richard E Small memory footprint fast elliptic encryption
US20060291649A1 (en) * 2005-06-22 2006-12-28 Crandall Richard E Chaos generator for accumulation of stream entropy
US20070053509A1 (en) * 1999-01-11 2007-03-08 Farhad Pezeshki Method and apparatus for minimizing differential power attacks on processors
US7215773B1 (en) 1998-10-14 2007-05-08 Certicom.Corp. Key validation scheme
US7228417B2 (en) 2002-02-26 2007-06-05 America Online, Inc. Simple secure login with multiple-authentication providers
CN100334831C (en) * 1998-06-23 2007-08-29 微软公司 Technology of forming encryption signature and using said signature accompanied with product copy
EP1755272A3 (en) * 1999-03-30 2007-09-12 Pitney Bowes, Inc. Method for certifying public keys used to sign postal indicia and indicia so signed
US7290278B2 (en) 2003-10-02 2007-10-30 Aol Llc, A Delaware Limited Liability Company Identity based service system
US7412059B1 (en) 2002-11-27 2008-08-12 Voltage Security, Inc. Public-key encryption system
US7567669B2 (en) 1996-05-17 2009-07-28 Certicom Corp. Strengthened public key protocol
US7580521B1 (en) 2003-06-25 2009-08-25 Voltage Security, Inc. Identity-based-encryption system with hidden public key attributes
US20110016324A1 (en) * 1997-02-03 2011-01-20 Certicom Corp. Data card verification system
US7921292B1 (en) 2003-04-04 2011-04-05 Voltage Security, Inc. Secure messaging systems
US10148285B1 (en) 2012-07-25 2018-12-04 Erich Schmitt Abstraction and de-abstraction of a digital data stream
US10484173B2 (en) * 2017-01-03 2019-11-19 Nxp B.V. X-only generic mapping function for PACE protocol
US10795858B1 (en) 2014-02-18 2020-10-06 Erich Schmitt Universal abstraction and de-abstraction of a digital data stream

Families Citing this family (89)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6307935B1 (en) * 1991-09-17 2001-10-23 Apple Computer, Inc. Method and apparatus for fast elliptic encryption with direct embedding
US5373560A (en) * 1991-12-06 1994-12-13 Schlafly; Roger Partial modular reduction method
US10361802B1 (en) 1999-02-01 2019-07-23 Blanding Hovenweep, Llc Adaptive pattern recognition based control system and method
US5442707A (en) * 1992-09-28 1995-08-15 Matsushita Electric Industrial Co., Ltd. Method for generating and verifying electronic signatures and privacy communication using elliptic curves
US5497423A (en) * 1993-06-18 1996-03-05 Matsushita Electric Industrial Co., Ltd. Method of implementing elliptic curve cryptosystems in digital signatures or verification and privacy communication
EP0804758B1 (en) * 1994-07-29 2005-11-09 Certicom Corp. Elliptic curve encryption systems
US5822341A (en) * 1995-04-06 1998-10-13 Advanced Hardware Architectures, Inc. Multiport RAM for use within a viterbi decoder
US5799090A (en) * 1995-09-25 1998-08-25 Angert; Joseph C. pad encryption method and software
US6075858A (en) * 1995-10-27 2000-06-13 Scm Microsystems (U.S.) Inc. Encryption key system and method
US5764772A (en) * 1995-12-15 1998-06-09 Lotus Development Coporation Differential work factor cryptography method and system
US5870470A (en) * 1996-02-20 1999-02-09 International Business Machines Corporation Method and apparatus for encrypting long blocks using a short-block encryption procedure
US5999626A (en) 1996-04-16 1999-12-07 Certicom Corp. Digital signatures on a smartcard
US5737424A (en) * 1996-06-04 1998-04-07 Software Security, Inc. Method and system for secure distribution of protected data using elliptic curve systems
CA2262549C (en) * 1996-08-16 2001-06-12 Bell Communications Research, Inc. Accelerating public-key cryptography by precomputing randomly generated pairs
WO1998008323A1 (en) 1996-08-19 1998-02-26 Ntru Cryptosystems, Inc. Public key cryptosystem method and apparatus
JPH10133576A (en) * 1996-10-31 1998-05-22 Hitachi Ltd Open key ciphering method and device therefor
US6005939A (en) * 1996-12-06 1999-12-21 International Business Machines Corporation Method and apparatus for storing an internet user's identity and access rights to world wide web resources
US6154541A (en) * 1997-01-14 2000-11-28 Zhang; Jinglong F Method and apparatus for a robust high-speed cryptosystem
US6088453A (en) * 1997-01-27 2000-07-11 Kabushiki Kaisha Toshiba Scheme for computing Montgomery division and Montgomery inverse realizing fast implementation
US6782100B1 (en) 1997-01-29 2004-08-24 Certicom Corp. Accelerated finite field operations on an elliptic curve
US6154542A (en) * 1997-12-17 2000-11-28 Apple Computer, Inc. Method and apparatus for simultaneously encrypting and compressing data
TW419925B (en) * 1998-01-27 2001-01-21 Mitsubishi Electric Corp Method and apparatus for arithmetic operation and recording medium thereof
DE69930334T2 (en) 1998-01-28 2006-11-09 Hitachi, Ltd. IC card equipped with a processing system for elliptic curve encryption
JPH11242434A (en) * 1998-02-26 1999-09-07 Hitachi Ltd Elliptic curve cipher executing method and cipher processing system
US6724895B1 (en) 1998-06-18 2004-04-20 Supersensor (Proprietary) Limited Electronic identification system and method with source authenticity verification
JP3542278B2 (en) 1998-06-25 2004-07-14 株式会社東芝 Montgomery reduction device and recording medium
US6212279B1 (en) 1998-06-26 2001-04-03 The United States Of America As Represented By The United States National Security Agency Method of elliptic curve cryptographic key exchange using reduced base tau expansion in non-adjacent form
AU6420599A (en) 1998-10-06 2000-04-26 Robert M. Chavez Digital elections network system with online voting and polling
JP2000132376A (en) 1998-10-27 2000-05-12 Fujitsu Ltd Remainder calculation method, multiplication remainder calculation method, remainder calculator, multiplication remainder calculator and recording medium
US6507656B1 (en) * 1999-01-27 2003-01-14 Lucent Technologies Inc. Non malleable encryption apparatus and method
CA2262316A1 (en) * 1999-02-22 2000-08-22 Ibm Canada Limited-Ibm Canada Limitee System and method for detecting release-to-release binary compatibility in compiled object code
US6490352B1 (en) 1999-03-05 2002-12-03 Richard Schroeppel Cryptographic elliptic curve apparatus and method
US7286665B1 (en) * 1999-04-06 2007-10-23 Contentguard Holdings, Inc. System and method for transferring the right to decode messages
US6959085B1 (en) * 1999-05-03 2005-10-25 Ntru Cryptosystems, Inc. Secure user identification based on ring homomorphisms
DE19935286A1 (en) * 1999-07-27 2001-02-01 Deutsche Telekom Ag Process for the secure distributed generation of an encryption key
US7200225B1 (en) * 1999-11-12 2007-04-03 Richard Schroeppel Elliptic curve point ambiguity resolution apparatus and method
US7215771B1 (en) 2000-06-30 2007-05-08 Western Digital Ventures, Inc. Secure disk drive comprising a secure drive key and a drive ID for implementing secure communication over a public network
US7003674B1 (en) 2000-07-31 2006-02-21 Western Digital Ventures, Inc. Disk drive employing a disk with a pristine area for storing encrypted data accessible only by trusted devices or clients to facilitate secure network communications
US7155616B1 (en) 2000-07-31 2006-12-26 Western Digital Ventures, Inc. Computer network comprising network authentication facilities implemented in a disk drive
US7327846B1 (en) * 2000-09-05 2008-02-05 Chung Nan Chang Secure cryptographic key exchange and verifiable digital signature
US20020133703A1 (en) * 2001-03-13 2002-09-19 Morgan Dan C. On-line certificate of authenticity for collectibles cross-reference to related applications
US7181017B1 (en) 2001-03-23 2007-02-20 David Felsher System and method for secure three-party communications
US20020141586A1 (en) * 2001-03-29 2002-10-03 Aladdin Knowledge Systems Ltd. Authentication employing the bluetooth communication protocol
US7137000B2 (en) 2001-08-24 2006-11-14 Zih Corp. Method and apparatus for article authentication
HK1038152A2 (en) * 2001-09-10 2002-02-15 Kar Wai Ho A method of digital signature
US20030061947A1 (en) * 2001-10-01 2003-04-03 Hohberger Clive P. Method and apparatus for associating on demand certain selected media and value-adding elements
TW566008B (en) * 2001-11-28 2003-12-11 Univ Nat Chiao Tung Apparatus for solving key equation polynomials in decoding error correction codes
DE10161137B4 (en) * 2001-12-12 2008-02-14 Siemens Ag Method and system for cryptographically processing data
JP2004054128A (en) * 2002-07-23 2004-02-19 Sony Corp Encrypting system
CN100440776C (en) * 2002-11-29 2008-12-03 北京华大信安科技有限公司 Elliptic curve signature and signature verification method and apparatus
US9818136B1 (en) 2003-02-05 2017-11-14 Steven M. Hoffberg System and method for determining contingent relevance
GB0314557D0 (en) * 2003-06-21 2003-07-30 Koninkl Philips Electronics Nv Improved reduction calculations
CA2935823C (en) 2005-01-18 2019-01-15 Certicom Corp. Accelerated verification of digital signatures and public keys
US8467535B2 (en) * 2005-01-18 2013-06-18 Certicom Corp. Accelerated verification of digital signatures and public keys
US7617397B2 (en) * 2005-04-29 2009-11-10 Microsoft Corporation Systems and methods for generation and validation of isogeny-based signatures
CA2542556C (en) 2005-06-03 2014-09-16 Tata Consultancy Services Limited An authentication system executing an elliptic curve digital signature cryptographic process
US8874477B2 (en) 2005-10-04 2014-10-28 Steven Mark Hoffberg Multifactorial optimization system and method
US20070124584A1 (en) * 2005-11-30 2007-05-31 Microsoft Corporation Proving ownership of shared information to a third party
US20070130462A1 (en) * 2005-12-06 2007-06-07 Law Eric C W Asynchronous encryption for secured electronic communications
KR100850202B1 (en) * 2006-03-04 2008-08-04 삼성전자주식회사 Cryptographic method for countering DFA using ECC fast Montgomery power ladder algorithm
US7664259B2 (en) * 2006-03-09 2010-02-16 Motorola, Inc. Encryption and verification using partial public key
DE102006013515A1 (en) * 2006-03-23 2007-10-04 Siemens Ag Cryptographic method with elliptic curves
US8311214B2 (en) * 2006-04-24 2012-11-13 Motorola Mobility Llc Method for elliptic curve public key cryptographic validation
US7907723B2 (en) * 2006-10-11 2011-03-15 Frank Rubin Device, system and method for fast secure message encryption without key distribution
US7912213B2 (en) * 2006-10-11 2011-03-22 Frank Rubin Device, system and method for fast secure message encryption without key distribution
US8098815B2 (en) * 2006-10-11 2012-01-17 Frank Rubin Device, system and method for cryptographic key exchange
US8090097B2 (en) * 2006-10-11 2012-01-03 Frank Rubin Device, system and method for cryptographic key exchange
US8607070B2 (en) * 2006-12-20 2013-12-10 Kingston Technology Corporation Secure storage system and method of use
US7856101B2 (en) * 2007-02-07 2010-12-21 King Fahd University Of Petroleum And Minerals Method for elliptic curve scalar multiplication
US8102998B2 (en) * 2007-05-02 2012-01-24 King Fahd University Of Petroleum And Minerals Method for elliptic curve scalar multiplication using parameterized projective coordinates
US20080273695A1 (en) * 2007-05-02 2008-11-06 Al-Gahtani Theeb A Method for elliptic curve scalar multiplication using parameterized projective coordinates
US8499168B2 (en) * 2007-05-09 2013-07-30 Kingston Technology Corporation Secure and scalable solid state disk system
US8010768B2 (en) * 2007-05-09 2011-08-30 Kingston Technology Corporation Secure and scalable solid state disk system
US8527781B2 (en) * 2007-05-09 2013-09-03 Kingston Technology Corporation Secure and scalable solid state disk system
CA2591280A1 (en) * 2007-06-12 2008-12-12 Nikolajs Volkova A new digital signature scheme
US20090313171A1 (en) * 2008-06-17 2009-12-17 Microsoft Corporation Electronic transaction verification
US9521120B2 (en) * 2009-04-23 2016-12-13 General Electric Technology Gmbh Method for securely transmitting control data from a secure network
CN102036235A (en) * 2009-09-28 2011-04-27 西门子(中国)有限公司 Device and method for identity authentication
WO2012011564A1 (en) * 2010-07-23 2012-01-26 日本電信電話株式会社 Encryption device, decryption device, encryption method, decryption method, program, and recording medium
US8745376B2 (en) 2011-10-14 2014-06-03 Certicom Corp. Verifying implicit certificates and digital signatures
US9449167B2 (en) * 2012-09-12 2016-09-20 Infosys Limited Method and system for securely accessing different services based on single sign on
CN103107890B (en) * 2013-02-08 2016-08-31 彭艳兵 A kind of multi-way encryption, signature, the method for zero-knowledge proof
US9836281B2 (en) 2013-03-12 2017-12-05 Greg J. Wright Encryption method and system using a random bit string encryption key
CN105610583B (en) * 2014-11-04 2018-10-26 上海华虹集成电路有限责任公司 ECDSA methods for resisting error curve attack
US10412098B2 (en) 2015-12-11 2019-09-10 Amazon Technologies, Inc. Signed envelope encryption
US9705859B2 (en) 2015-12-11 2017-07-11 Amazon Technologies, Inc. Key exchange through partially trusted third party
CN106712950A (en) * 2017-01-18 2017-05-24 中译语通科技(北京)有限公司 Encryption method for corpus data through RSA public key encryption algorithm based on congruent numbers
US10341098B2 (en) * 2017-01-24 2019-07-02 Nxp B.V. Method of generating cryptographic key pairs
US11522717B2 (en) 2019-07-23 2022-12-06 Signa Tech Llc Signature token system

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5146500A (en) * 1991-03-14 1992-09-08 Omnisec A.G. Public key cryptographic system using elliptic curves over rings
US5159632A (en) * 1991-09-17 1992-10-27 Next Computer, Inc. Method and apparatus for public key exchange in a cryptographic system
US5218637A (en) * 1987-09-07 1993-06-08 L'etat Francais Represente Par Le Ministre Des Postes, Des Telecommunications Et De L'espace Method of transferring a secret, by the exchange of two certificates between two microcomputers which establish reciprocal authorization
US5271061A (en) * 1991-09-17 1993-12-14 Next Computer, Inc. Method and apparatus for public key exchange in a cryptographic system
US5272755A (en) * 1991-06-28 1993-12-21 Matsushita Electric Industrial Co., Ltd. Public key cryptosystem with an elliptic curve
US5521980A (en) * 1993-08-02 1996-05-28 Brands; Stefanus A. Privacy-protected transfer of electronic information

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4200770A (en) * 1977-09-06 1980-04-29 Stanford University Cryptographic apparatus and method
US4424414A (en) * 1978-05-01 1984-01-03 Board Of Trustees Of The Leland Stanford Junior University Exponentiation cryptographic apparatus and method
EP0085130A1 (en) * 1982-02-02 1983-08-10 Omnet Associates Method and apparatus for maintaining the privacy of digital messages conveyed by public transmission
US5054066A (en) * 1988-11-16 1991-10-01 Grumman Corporation Error correcting public key cryptographic method and program
BE1003932A6 (en) * 1989-04-28 1992-07-22 Musyck Emile Cryptographic system by bit data block.
US5231668A (en) * 1991-07-26 1993-07-27 The United States Of America, As Represented By The Secretary Of Commerce Digital signature algorithm
US6307935B1 (en) * 1991-09-17 2001-10-23 Apple Computer, Inc. Method and apparatus for fast elliptic encryption with direct embedding
US5497423A (en) * 1993-06-18 1996-03-05 Matsushita Electric Industrial Co., Ltd. Method of implementing elliptic curve cryptosystems in digital signatures or verification and privacy communication

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5218637A (en) * 1987-09-07 1993-06-08 L'etat Francais Represente Par Le Ministre Des Postes, Des Telecommunications Et De L'espace Method of transferring a secret, by the exchange of two certificates between two microcomputers which establish reciprocal authorization
US5146500A (en) * 1991-03-14 1992-09-08 Omnisec A.G. Public key cryptographic system using elliptic curves over rings
US5272755A (en) * 1991-06-28 1993-12-21 Matsushita Electric Industrial Co., Ltd. Public key cryptosystem with an elliptic curve
US5159632A (en) * 1991-09-17 1992-10-27 Next Computer, Inc. Method and apparatus for public key exchange in a cryptographic system
US5271061A (en) * 1991-09-17 1993-12-14 Next Computer, Inc. Method and apparatus for public key exchange in a cryptographic system
US5463690A (en) * 1991-09-17 1995-10-31 Next Computer, Inc. Method and apparatus for public key exchange in a cryptographic system
US5521980A (en) * 1993-08-02 1996-05-28 Brands; Stefanus A. Privacy-protected transfer of electronic information

Cited By (108)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020122555A1 (en) * 1991-09-17 2002-09-05 Next Computer, Inc. Method and apparatus for digital signature authentication
US6751318B2 (en) * 1991-09-17 2004-06-15 Next Software, Inc. Method and apparatus for digital signature authentication
US20040250081A1 (en) * 1991-09-17 2004-12-09 Crandall Richard E. Method and apparatus for digital signature authentication
US7603560B2 (en) * 1991-09-17 2009-10-13 Crandall Richard E Method and apparatus for digital signature authentication
US5805703A (en) * 1991-09-17 1998-09-08 Next Software, Inc. Method and apparatus for digital signature authentication
US6049610A (en) * 1991-09-17 2000-04-11 Next Software, Inc. Method and apparatus for digital signature authentication
US6563928B1 (en) 1995-05-18 2003-05-13 Certicom Corp. Strengthened public key protocol
US5933504A (en) * 1995-05-18 1999-08-03 Certicom Corp. Strengthened public key protocol
US7567669B2 (en) 1996-05-17 2009-07-28 Certicom Corp. Strengthened public key protocol
US8953787B2 (en) 1996-05-17 2015-02-10 Certicom Corp. Strengthened public key protocol
US20100014663A1 (en) * 1996-05-17 2010-01-21 Certicom Corp. Strengthened public key protocol
US8983064B2 (en) 1996-05-17 2015-03-17 Certicom Corp. Strengthened public key protocol
US8229113B2 (en) 1996-05-17 2012-07-24 Certicom Corp. Strengthened public key protocol
US6212281B1 (en) * 1996-10-11 2001-04-03 Certicom Corp. Digital signature protocol
US20110016324A1 (en) * 1997-02-03 2011-01-20 Certicom Corp. Data card verification system
US9990796B2 (en) 1997-02-03 2018-06-05 Certicom Corp. Data card verification system
US8307211B2 (en) 1997-02-03 2012-11-06 Certicom Corp. Data card verification system
US8966271B2 (en) 1997-02-03 2015-02-24 Certicom Corp. Data card verification system
US6279110B1 (en) 1997-11-10 2001-08-21 Certicom Corporation Masked digital signatures
US8359468B2 (en) 1997-11-10 2013-01-22 Certicom Corp. Masked digital signatures
US7552329B2 (en) 1997-11-10 2009-06-23 Certicom Corp. Masked digital signatures
US7996676B2 (en) 1997-11-10 2011-08-09 Certicom Corp. Masked digital signatures
US20090319790A1 (en) * 1997-11-10 2009-12-24 Certicom Corp. Masked digital signatures
US20080005570A1 (en) * 1997-11-10 2008-01-03 Certicom Corp. Masked digital signatures
US7260723B2 (en) 1997-11-10 2007-08-21 Certicom Corp. Masked digital signatures
US8732467B2 (en) 1997-11-10 2014-05-20 Certicom Corp. Masked digital signatures
WO1999030458A1 (en) * 1997-12-05 1999-06-17 Secured Information Technology, Inc. Transformation methods for optimizing elliptic curve cryptographic computations
US6209093B1 (en) 1998-06-23 2001-03-27 Microsoft Corporation Technique for producing a privately authenticatable product copy indicia and for authenticating such an indicia
US6163841A (en) * 1998-06-23 2000-12-19 Microsoft Corporation Technique for producing privately authenticatable cryptographic signatures and for authenticating such signatures
CN100334831C (en) * 1998-06-23 2007-08-29 微软公司 Technology of forming encryption signature and using said signature accompanied with product copy
US6243467B1 (en) 1998-07-23 2001-06-05 The United States Of America As Represented By The National Security Agency Method of elliptic curve cryptographic digital signature generation and verification using reduced base tau expansion in non-adjacent form
US8594324B2 (en) 1998-10-14 2013-11-26 Certicom Corp. Key validation scheme
US8116451B2 (en) 1998-10-14 2012-02-14 Certicom Corporation Key validation scheme
US20070147607A1 (en) * 1998-10-14 2007-06-28 Johnson Donald B Key validation scheme
US7215773B1 (en) 1998-10-14 2007-05-08 Certicom.Corp. Key validation scheme
US8660264B2 (en) 1999-01-11 2014-02-25 Certicom Corp. Method and apparatus for minimizing differential power attacks on processors
US20070053509A1 (en) * 1999-01-11 2007-03-08 Farhad Pezeshki Method and apparatus for minimizing differential power attacks on processors
US8666070B2 (en) * 1999-01-11 2014-03-04 Certicom Corp. Method and apparatus for minimizing differential power attacks on processors
US20100278334A1 (en) * 1999-01-11 2010-11-04 Certicom Corp. Method and apparatus for minimizing differential power attacks on processors
US8666063B2 (en) 1999-01-11 2014-03-04 Certicom Corp. Method and apparatus for minimizing differential power attacks on processors
EP1755272A3 (en) * 1999-03-30 2007-09-12 Pitney Bowes, Inc. Method for certifying public keys used to sign postal indicia and indicia so signed
US20040001455A1 (en) * 2000-03-24 2004-01-01 Smarttrust Systems Oy Method and system for identification of digitally signed messages in a telecommunication system
US6898284B2 (en) 2000-08-18 2005-05-24 The United States Of America As Represented By The National Security Agency Cryptographic identification and digital signature method using efficient elliptic curve
US20020021803A1 (en) * 2000-08-18 2002-02-21 Solinas Jerome Anthony Cryptographic identification and digital signature method using efficient elliptic curve
US20020025034A1 (en) * 2000-08-18 2002-02-28 Solinas Jerome Anthony Cryptographic encryption method using efficient elliptic curve
US20020021810A1 (en) * 2000-08-18 2002-02-21 Solinas Jerome Anthony Cryptographic key exchange method using efficient elliptic curve
US6993136B2 (en) 2000-08-18 2006-01-31 The United States Of America As Represented By The National Security Agency Cryptographic key exchange method using efficient elliptic curve
US7020282B1 (en) * 2000-09-05 2006-03-28 Chung Nan Chang Simplified secure, swift cryptographic key exchange
US20030081785A1 (en) * 2001-08-13 2003-05-01 Dan Boneh Systems and methods for identity-based encryption and related cryptographic techniques
US7113594B2 (en) 2001-08-13 2006-09-26 The Board Of Trustees Of The Leland Stanford University Systems and methods for identity-based encryption and related cryptographic techniques
US9356779B2 (en) 2001-08-13 2016-05-31 The Board Of Trustees Of The Leland Stanford Junior University Systems and methods for identity-based encryption and related cryptographic techniques
US7634087B2 (en) 2001-08-13 2009-12-15 The Board Of Trustees Of The Leland Stanford Junior University Systems and methods for identity-based encryption and related cryptographic techniques
US20100208895A1 (en) * 2001-08-13 2010-08-19 The Board Of Trustees Of The Leland Stanford Junior University Systems and methods for identity-based encryption and related cryptographic techniques
US20090034714A9 (en) * 2001-08-13 2009-02-05 Dan Boneh Systems and methods for identity-based encryption and related cryptographic techniques
US20070041583A1 (en) * 2001-08-13 2007-02-22 Dan Boneh Systems and methods for identity-based encryption and related cryptographic techniques
US8130964B2 (en) 2001-08-13 2012-03-06 The Board Of Trustees Of The Leland Stanford Junior University Systems and methods for identity-based encryption and related cryptographic techniques
US20070169181A1 (en) * 2002-02-26 2007-07-19 James Roskind Simple, secure login with multiple authentication providers
US20100251347A1 (en) * 2002-02-26 2010-09-30 Aol Inc. Simple, secure login with multiple authentication providers
US8196189B2 (en) 2002-02-26 2012-06-05 Aol Llc Simple, secure login with multiple authentication providers
US7765584B2 (en) 2002-02-26 2010-07-27 Aol Inc. Simple, secure login with multiple authentication providers
US7228417B2 (en) 2002-02-26 2007-06-05 America Online, Inc. Simple secure login with multiple-authentication providers
US7024559B1 (en) 2002-06-28 2006-04-04 The United States Of America As Represented By The National Security Agency Method of elliptic curve digital signature using expansion in joint sparse form
US7062043B1 (en) 2002-06-28 2006-06-13 The United States Of America As Represented By The National Security Agency Method of elliptic curve digital signature using coefficient splitting
US7831829B2 (en) 2002-11-14 2010-11-09 Voltage Security, Inc. Identity-based encryption system
US20040098589A1 (en) * 2002-11-14 2004-05-20 Identicrypt, Inc. Identity-based encryption system
US20090034742A1 (en) * 2002-11-14 2009-02-05 Guido Appenzeller Identity-based encryption system
US7424614B2 (en) 2002-11-14 2008-09-09 Voltage Security, Inc. Identity-based encryption system
US6886096B2 (en) 2002-11-14 2005-04-26 Voltage Security, Inc. Identity-based encryption system
US7412059B1 (en) 2002-11-27 2008-08-12 Voltage Security, Inc. Public-key encryption system
US7003117B2 (en) 2003-02-05 2006-02-21 Voltage Security, Inc. Identity-based encryption system for secure data distribution
US20060123238A1 (en) * 2003-02-05 2006-06-08 Kacker Rishi R Identity-based encryption system for secure data distribution
US8024769B2 (en) 2003-02-05 2011-09-20 Voltage Security, Inc. Identity-based encryption system for secure data distribution
US20040179684A1 (en) * 2003-03-14 2004-09-16 Identicrypt, Inc. Identity-based-encryption messaging system
US8086857B2 (en) 2003-03-14 2011-12-27 Voltage Security, Inc. Identity-based-encryption messaging system
US20090307497A1 (en) * 2003-03-14 2009-12-10 Guido Appenzeller Identity-based-encryption messaging system
US7571321B2 (en) 2003-03-14 2009-08-04 Voltage Security, Inc. Identity-based-encryption messaging system
US7921292B1 (en) 2003-04-04 2011-04-05 Voltage Security, Inc. Secure messaging systems
US8301889B1 (en) 2003-04-04 2012-10-30 Voltage Security, Inc. Secure messaging systems
US8627084B1 (en) 2003-04-04 2014-01-07 Voltage Security, Inc. Secure messaging systems
US7580521B1 (en) 2003-06-25 2009-08-25 Voltage Security, Inc. Identity-based-encryption system with hidden public key attributes
US7017181B2 (en) 2003-06-25 2006-03-21 Voltage Security, Inc. Identity-based-encryption messaging system with public parameter host servers
US7961879B1 (en) 2003-06-25 2011-06-14 Voltage Security, Inc. Identity-based-encryption system with hidden public key attributes
US7765582B2 (en) * 2003-06-25 2010-07-27 Voltage Security, Inc. Identity-based-encryption messaging system with public parameter host servers
US20070177731A1 (en) * 2003-06-25 2007-08-02 Terence Spies Identity-based-encryption messaging system with public parameter host servers
US20050010801A1 (en) * 2003-06-25 2005-01-13 Terence Spies Identity-based-encryption messaging system with public parameter host servers
US20080049937A1 (en) * 2003-09-25 2008-02-28 Pauker Matthew J Secure message system with remote decryption service
US20050071632A1 (en) * 2003-09-25 2005-03-31 Pauker Matthew J. Secure message system with remote decryption service
US8171563B2 (en) 2003-09-25 2012-05-01 Voltage Security, Inc. Secure message system with remote decryption service
US7698745B2 (en) 2003-09-25 2010-04-13 Voltage Security, Inc. Secure message system with remote decryption service
US20100161984A1 (en) * 2003-09-25 2010-06-24 Pauker Matthew J Secure message system with remote decryption service
US7266847B2 (en) 2003-09-25 2007-09-04 Voltage Security, Inc. Secure message system with remote decryption service
US7290278B2 (en) 2003-10-02 2007-10-30 Aol Llc, A Delaware Limited Liability Company Identity based service system
US7103911B2 (en) 2003-10-17 2006-09-05 Voltage Security, Inc. Identity-based-encryption system with district policy information
US20050084100A1 (en) * 2003-10-17 2005-04-21 Terence Spies Identity-based-encryption system with district policy information
US8353023B2 (en) 2003-12-22 2013-01-08 Voltage Security, Inc. Identity-based-encryption message management system
US7523314B2 (en) 2003-12-22 2009-04-21 Voltage Security, Inc. Identity-based-encryption message management system
US20090172804A1 (en) * 2003-12-22 2009-07-02 Terence Spies Identity-based-encryption message management system
US20050138353A1 (en) * 2003-12-22 2005-06-23 Terence Spies Identity-based-encryption message management system
US8041953B2 (en) 2003-12-22 2011-10-18 Voltage Security, Inc. Identity-based-encryption message management system
US7650507B2 (en) * 2005-01-07 2010-01-19 Apple Inc. Small memory footprint fast elliptic encryption
US20090138721A1 (en) * 2005-01-07 2009-05-28 Crandall Richard E Small Memory Footprint Fast Elliptic Encryption
US20060174126A1 (en) * 2005-02-03 2006-08-03 Crandall Richard E Small memory footprint fast elliptic encryption
US7607019B2 (en) 2005-02-03 2009-10-20 Apple Inc. Small memory footprint fast elliptic encryption
US7587047B2 (en) * 2005-06-22 2009-09-08 Apple Inc. Chaos generator for accumulation of stream entropy
US20060291649A1 (en) * 2005-06-22 2006-12-28 Crandall Richard E Chaos generator for accumulation of stream entropy
US10148285B1 (en) 2012-07-25 2018-12-04 Erich Schmitt Abstraction and de-abstraction of a digital data stream
US10795858B1 (en) 2014-02-18 2020-10-06 Erich Schmitt Universal abstraction and de-abstraction of a digital data stream
US10484173B2 (en) * 2017-01-03 2019-11-19 Nxp B.V. X-only generic mapping function for PACE protocol

Also Published As

Publication number Publication date
US6285760B1 (en) 2001-09-04
US5271061A (en) 1993-12-14
US7603560B2 (en) 2009-10-13
US20020122555A1 (en) 2002-09-05
US5805703A (en) 1998-09-08
US20040250081A1 (en) 2004-12-09
US6049610A (en) 2000-04-11
US6751318B2 (en) 2004-06-15
US5463690A (en) 1995-10-31

Similar Documents

Publication Publication Date Title
US5581616A (en) Method and apparatus for digital signature authentication
EP0997016B1 (en) Method and apparatus for fast elliptical encryption with direct embedding
US5159632A (en) Method and apparatus for public key exchange in a cryptographic system
US5799088A (en) Non-deterministic public key encrypton system
AU677269B2 (en) A cryptographic method
US4200770A (en) Cryptographic apparatus and method
US7469048B2 (en) Methods for point compression for jacobians of hyperelliptic curves
CN109039640B (en) Encryption and decryption hardware system and method based on RSA cryptographic algorithm
KR20000071078A (en) Cyclotomic polynomial construction of discrete logarithm cryptosystems over finite fields
US7054444B1 (en) Public and private key cryptographic method
US20040228485A1 (en) Method and apparatus for the generation of public key based on a user-defined ID in a cryptosystem
Vanstone et al. Elliptic curve cryptosystems using curves of smooth order over the ring Z/sub n
US7248692B2 (en) Method of and apparatus for determining a key pair and for generating RSA keys
US6959091B1 (en) Cryptography private key storage and recovery method and apparatus
US6772184B2 (en) Method for efficient modular division over prime integer fields
US6826586B2 (en) Method for efficient computation of point doubling operation of elliptic curve point scalar multiplication over finite fields F(2m)
KR100326226B1 (en) Method of Generating Matix Group Public Key
JPH08251155A (en) Ciphering device, deciphering device, ciphering and deciphering device and cipher system
CA2156780A1 (en) Apparatus and method for cryptographic system users to obtain a jointly determined, secret, shared and unique bit string

Legal Events

Date Code Title Description
AS Assignment

Owner name: NEXT COMPUTER, INC., CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:CRANDALL, RICHARD E.;REEL/FRAME:007643/0951

Effective date: 19950907

AS Assignment

Owner name: NEXT SOFTWARE, INC., CALIFORNIA

Free format text: CHANGE OF NAME;ASSIGNOR:NEXT COMPUTER, INC.;REEL/FRAME:007991/0276

Effective date: 19951213

STCF Information on status: patent grant

Free format text: PATENTED CASE

REMI Maintenance fee reminder mailed
FPAY Fee payment

Year of fee payment: 4

SULP Surcharge for late payment
FEPP Fee payment procedure

Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Free format text: PAYER NUMBER DE-ASSIGNED (ORIGINAL EVENT CODE: RMPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

FPAY Fee payment

Year of fee payment: 8

FEPP Fee payment procedure

Free format text: PAYER NUMBER DE-ASSIGNED (ORIGINAL EVENT CODE: RMPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

FPAY Fee payment

Year of fee payment: 12